Booking Activities Vulnerabilities

The Booking Activities plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.18.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is pres...

CVSS:

8.1

Affected:

up to 1.18.4

Fixed in:

1.18.5

Disclosed:

Aug 13, 2026

CVE-2026-28176 on NVD →

The Booking Activities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.16.48.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.16.48.1

Fixed in:

1.17.0

Disclosed:

Apr 13, 2026

CVE-2026-39525 on NVD →

The Booking Activities plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.16.44. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

CVSS:

9.8

Affected:

up to 1.16.44

Fixed in:

1.16.45

Disclosed:

Jan 20, 2026

CVE-2025-67953 on NVD →

The Booking Activities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.15.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can suc...

CVSS:

6.1

Affected:

up to 1.15.19

Fixed in:

1.15.20

Disclosed:

Mar 28, 2024

CVE-2024-30449 on NVD →