Booking Package (Unknown) - vulnerabilities (CVEs)

6 CVEs, 5 in the last 30 days, 1 known versions, newest CVE from 2026-10-28. Vendor: Unknown.

CVEs of Booking Package

• CVE-2026-105997 - CVSS 5.3 (medium), 2026-10-28: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to…
• CVE-2026-105999 - CVSS 5.3 (medium), 2026-10-21: The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response,…
• CVE-2026-105998 - CVSS 5.3 (medium), 2026-10-21: The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state,…
• CVE-2026-105996 - CVSS 4.8 (medium), 2026-10-21: The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead…
• CVE-2026-105995 - CVSS 5.3 (medium), 2026-10-10: The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated…
• CVE-2026-16986 - CVSS 5.3 (medium), 2026-08-26: The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected…