Vulnerabilities / Booking Package

Booking Package vulnerabilities

Advisories WPSec published for Booking Package. Other sources may list more. Its attack surface: Booking Package on WPSec AttackSurface.

Published	ID	Vulnerability	Severity	Fixed in
2026-10-21	WPSEC-2026-1382	Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action	Medium 5.3	1.7.33
2026-10-21	WPSEC-2026-1381	Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass	Medium 5.3	1.7.33
2026-10-21	WPSEC-2026-1380	Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services	Medium 5.3	1.7.33
2026-10-21	WPSEC-2026-1379	Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse	Medium 5.3	1.7.33
2026-10-16	WPSEC-2026-1084	Booking Package <= 1.7.31 - Unauthenticated Payment Bypass via Booking Submission	Medium 5.3	1.7.32
2026-10-14	WPSEC-2026-0942	Booking Package <= 1.7.30 - Authenticated (Booking Package Editor+) Stored Cross-Site Scripting via Front-End JavaScript Setting	Medium 4.9	1.7.31
2026-10-14	WPSEC-2026-0941	Booking Package <= 1.7.30 - Unauthenticated Sensitive Information Exposure via 'createCustomer' Action	Medium 5.3	1.7.31
2026-10-14	WPSEC-2026-0940	Booking Package <= 1.7.30 - Missing Authorization to Unauthenticated Paid Subscription Deactivation	Medium 5.3	1.7.31
2026-10-07	WPSEC-2026-0575	Booking Package <= 1.7.29 - Unauthenticated Sensitive Information Exposure via 'public' Parameter	High 7.5	1.7.30
2026-10-07	WPSEC-2026-0574	Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	Medium 6.4	1.7.30