VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 9 known issues Latest disclosed Jun 05, 2026

Booking Package Vulnerabilities

Review known vulnerability records for the WordPress plugin Booking Package (`booking-package`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-9851, CVE-2026-4911 and CVE-2026-40774, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
9
High or Critical
3
Patch Coverage
100%
Last Updated
Jun 06, 2026
Related Security Guides

Use these guides while reviewing Booking Package fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Booking Package remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
9
1. Match the Package
Confirm the installed WordPress plugin slug is booking-package before acting on any CVE from this cluster.
2. Sort by Severity
Start with 3 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
9 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2023-37389 Critical
Authorization Bypass remediation for Booking Package

Affected range: Versions before 1.5.99. Fixed version: 1.5.99.

CVE-2022-0709 High
Vulnerability remediation for Booking Package

Affected range: Versions before 1.5.29. Fixed version: 1.5.29.

CVE-2026-9851 High
Authorization Bypass remediation for Booking Package

Affected range: Versions up to 1.7.16. Fixed version: 1.7.17.

CVE-2024-13508 Medium
Cross-Site Scripting remediation for Booking Package

Affected range: Versions up to 1.6.72. Fixed version: 1.6.73.

Priority CVE Quick Links

Fast paths into Booking Package CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
9
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2023-37389
Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset
 Authorization Bypass Versions before 1.5.99 1.5.99 CVSS 9.8
CVE-2022-0709
Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure
 Vulnerability Versions before 1.5.29 1.5.29 CVSS 7.5
CVE-2026-9851
Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account...
 Authorization Bypass Versions up to 1.7.16 1.7.17 CVSS 7.2
CVE-2024-13508
Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter
 Cross-Site Scripting Versions up to 1.6.72 1.6.73 CVSS 6.1
CVE-2023-39918
Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'
 Cross-Site Scripting Versions up to 1.6.01 1.6.02 CVSS 6.1
CVE-2021-20840
Booking Package <= 1.5.10 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions before 1.5.11 1.5.11 CVSS 6.1
CVE-2026-4911
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Paramete...
 Vulnerability Versions up to 1.7.06 1.7.07 CVSS 5.3
CVE-2026-40774
Booking Package <= 1.7.06 - Missing Authorization
 Vulnerability Versions up to 1.7.06 1.7.07 CVSS 5.3
CVE-2023-37389 Critical 1.5.99
CVE-2023-37389 Booking Package Authorization Bypass

Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

CVE-2022-0709 High 1.5.29
CVE-2022-0709 Booking Package Vulnerability

Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure

CVE-2026-9851 High 1.7.17
CVE-2026-9851 Booking Package Authorization Bypass

Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

CVE-2024-13508 Medium 1.6.73
CVE-2024-13508 Booking Package Cross-Site Scripting

Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

CVE-2023-39918 Medium 1.6.02
CVE-2023-39918 Booking Package Cross-Site Scripting

Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

CVE-2021-20840 Medium 1.5.11
CVE-2021-20840 Booking Package Cross-Site Scripting

Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

CVE-2026-4911 Medium 1.7.07
CVE-2026-4911 Booking Package Vulnerability

Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

CVE-2026-40774 Medium 1.7.07
CVE-2026-40774 Booking Package Vulnerability

Booking Package <= 1.7.06 - Missing Authorization

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Booking Package so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
9 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 2 high severity findings.
Recent CVEs
CVE-2026-9851, CVE-2026-4911 and CVE-2026-40774
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Booking Package

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-9851
CVE-2026-9851: Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only valid...

Published
Jun 05, 2026
Patched Release
1.7.17
Affected Versions
Versions up to 1.7.16
Next Step
Update to 1.7.17 or newer if supported.
Review CVE-2026-9851 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-4911
CVE-2026-4911: Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commit...

Published
Apr 27, 2026
Patched Release
1.7.07
Affected Versions
Versions up to 1.7.06
Next Step
Update to 1.7.07 or newer if supported.
Review CVE-2026-4911 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-40774
CVE-2026-40774: Booking Package <= 1.7.06 - Missing Authorization

The Booking Package plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.06. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
Apr 21, 2026
Patched Release
1.7.07
Affected Versions
Versions up to 1.7.06
Next Step
Update to 1.7.07 or newer if supported.
Review CVE-2026-40774 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13508
CVE-2024-13508: Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Published
Feb 18, 2025
Patched Release
1.6.73
Affected Versions
Versions up to 1.6.72
Next Step
Update to 1.6.73 or newer if supported.
Review CVE-2024-13508 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-30516
CVE-2024-30516: Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

The Booking Package plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 1.6.27. This is due to insufficient validation on the pricing data being passed to the server. This makes it possible for unauthenticated attackers to modify the pri...

Published
Mar 28, 2024
Patched Release
1.6.29
Affected Versions
Versions up to 1.6.27
Next Step
Update to 1.6.29 or newer if supported.
Review CVE-2024-30516 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-39918
CVE-2023-39918: Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 1.6.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject ar...

Published
Aug 07, 2023
Patched Release
1.6.02
Affected Versions
Versions up to 1.6.01
Next Step
Update to 1.6.02 or newer if supported.
Review CVE-2023-39918 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2023-37389
CVE-2023-37389: Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

The Booking Package plugin for WordPress is vulnerable to Authorization Bypass in versions up to, and including 1.5.98 due to missing validation in the 'updateUser' function. This allows unauthenticated attackers to reset the email and password of any user on the site if they kno...

Published
Jul 05, 2023
Patched Release
1.5.99
Affected Versions
Versions before 1.5.99
Next Step
Update to 1.5.99 or newer if supported.
Review CVE-2023-37389 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2022-0709
CVE-2022-0709: Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

Published
Mar 09, 2022
Patched Release
1.5.29
Affected Versions
Versions before 1.5.29
Next Step
Update to 1.5.29 or newer if supported.
Review CVE-2022-0709 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2021-20840
CVE-2021-20840: Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.5.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pa...

Published
Nov 10, 2021
Patched Release
1.5.11
Affected Versions
Versions before 1.5.11
Next Step
Update to 1.5.11 or newer if supported.
Review CVE-2021-20840 fixed version details Open CVE Reference