murgroland vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20266

Newest CVEs

• CVE-2026-116557

  WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

  murgroland · WP Booking System – Booking Calendar

  Critical9.1
• CVE-2026-108123

  WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action

  murgroland · WP Booking System – Booking Calendar

  High7.5
• CVE-2026-109369

  WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse

  murgroland · WP Booking System – Booking Calendar

  Medium6.8
• CVE-2026-109368

  WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action

  murgroland · WP Booking System – Booking Calendar

  Medium6.5
• CVE-2026-111178

  WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

  murgroland · WP Booking System – Booking Calendar

  Medium4.9
• CVE-2026-107712

  WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter

  murgroland · WP Booking System – Booking Calendar

  Medium6.5
• CVE-2024-8797

  WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting

  murgroland · WP Booking System – Booking Calendar

  Medium6.1
• CVE-2024-8663

  WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting

  murgroland · WP Simple Booking Calendar

  Medium6.1