Vulnerabilities / Scheduling Plugin – Online Booking for WordPress
Scheduling Plugin – Online Booking for WordPress vulnerabilities
Advisories WPSec published for Scheduling Plugin – Online Booking for WordPress. Other sources may list more. Its attack surface: Scheduling Plugin – Online Booking for WordPress on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-01 | WPSEC-2026-0136 | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Subscriber+) Missing Authorization to Account Connection and Plugin Settings Modification | Medium 5.4 | 3.5.18 |
| 2026-10-01 | WPSEC-2026-0135 | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Missing Authorization to Account Disconnection | Medium 6.5 | 3.5.18 |
| 2026-10-01 | WPSEC-2026-0134 | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | Medium 6.4 | 3.5.18 |
| 2026-10-01 | WPSEC-2026-0133 | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Unauthenticated Authorization Bypass to Admin-Scoped REST API Proxy | High 8.2 | 3.5.18 |
License: CC BY 4.0