Bus Ticket Booking With Seat Reservation Vulnerabilities

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 5.6.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 5.6.8

Fixed in:

5.6.8

Disclosed:

May 7, 2026

CVE-2025-66105 on NVD →

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.6.5 (exclusive). This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 5.6.5

Fixed in:

5.6.5

Disclosed:

Mar 22, 2026

CVE-2026-39572 on NVD →

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 5.6.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. I...

CVSS:

8.1

Affected:

up to 5.6.2

Fixed in:

5.9.0

Disclosed:

Mar 5, 2026

CVE-2026-27095 on NVD →

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged r...

CVSS:

4.3

Affected:

up to 5.4.3

Fixed in:

5.4.5

Disclosed:

Jan 6, 2025

CVE-2024-49294 on NVD →

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbi...

CVSS:

4.4

Affected:

up to 5.3.5

Fixed in:

5.3.6

Disclosed:

Aug 28, 2024

CVE-2024-43985 on NVD →

The Bus Ticket Booking with Seat Reservation – WpBusTicketly | WordPress plugin plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

7.2

Affected:

up to 5.2.5

Fixed in:

5.2.6

Disclosed:

Nov 13, 2023

CVE-2023-30496 on NVD →

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

CVSS:

6.1

Affected:

up to 5.2.3

Fixed in:

5.2.4

Disclosed:

Aug 1, 2023

CVE-2023-4067 on NVD →