VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 7 known issues Latest disclosed Apr 27, 2026

Booking Package Vulnerabilities

Review known vulnerability records for the WordPress plugin Booking Package (`booking-package`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-4911, CVE-2024-13508 and CVE-2024-30516, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
7
High or Critical
2
Patch Coverage
100%
Last Updated
Apr 27, 2026
Priority CVE Quick Links

Fast paths into Booking Package CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
7
CVE-2023-37389 Critical 1.5.99
CVE-2023-37389 Booking Package Authorization Bypass

Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

CVE-2022-0709 High 1.5.29
CVE-2022-0709 Booking Package Vulnerability

Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure

CVE-2024-13508 Medium 1.6.73
CVE-2024-13508 Booking Package Cross-Site Scripting

Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

CVE-2023-39918 Medium 1.6.02
CVE-2023-39918 Booking Package Cross-Site Scripting

Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

CVE-2021-20840 Medium 1.5.11
CVE-2021-20840 Booking Package Cross-Site Scripting

Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

CVE-2026-4911 Medium 1.7.07
CVE-2026-4911 Booking Package Vulnerability

Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

CVE-2024-30516 Medium 1.6.29
CVE-2024-30516 Booking Package Vulnerability

Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Booking Package so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
7 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 1 high severity finding.
Recent CVEs
CVE-2026-4911, CVE-2024-13508 and CVE-2024-30516
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Booking Package

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-4911
CVE-2026-4911: Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commit...

Published
Apr 27, 2026
Patched Release
1.7.07
Affected Versions
Versions up to 1.7.06
Next Step
Update to 1.7.07 or newer if supported.
Open CVE-2026-4911 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13508
CVE-2024-13508: Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Published
Feb 18, 2025
Patched Release
1.6.73
Affected Versions
Versions up to 1.6.72
Next Step
Update to 1.6.73 or newer if supported.
Open CVE-2024-13508 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-30516
CVE-2024-30516: Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

The Booking Package plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 1.6.27. This is due to insufficient validation on the pricing data being passed to the server. This makes it possible for unauthenticated attackers to modify the pri...

Published
Mar 28, 2024
Patched Release
1.6.29
Affected Versions
Versions up to 1.6.27
Next Step
Update to 1.6.29 or newer if supported.
Open CVE-2024-30516 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-39918
CVE-2023-39918: Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 1.6.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject ar...

Published
Aug 07, 2023
Patched Release
1.6.02
Affected Versions
Versions up to 1.6.01
Next Step
Update to 1.6.02 or newer if supported.
Open CVE-2023-39918 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2023-37389
CVE-2023-37389: Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

The Booking Package plugin for WordPress is vulnerable to Authorization Bypass in versions up to, and including 1.5.98 due to missing validation in the 'updateUser' function. This allows unauthenticated attackers to reset the email and password of any user on the site if they kno...

Published
Jul 05, 2023
Patched Release
1.5.99
Affected Versions
Versions before 1.5.99
Next Step
Update to 1.5.99 or newer if supported.
Open CVE-2023-37389 Report Open CVE Reference
Plugin High Patched: Yes CVE-2022-0709
CVE-2022-0709: Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

Published
Mar 09, 2022
Patched Release
1.5.29
Affected Versions
Versions before 1.5.29
Next Step
Update to 1.5.29 or newer if supported.
Open CVE-2022-0709 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2021-20840
CVE-2021-20840: Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.5.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pa...

Published
Nov 10, 2021
Patched Release
1.5.11
Affected Versions
Versions before 1.5.11
Next Step
Update to 1.5.11 or newer if supported.
Open CVE-2021-20840 Report Open CVE Reference