Hbook Vulnerabilities

The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' parameters in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVSS:

7.2

Affected:

up to 2.1.9

Fixed in:

2.1.10

Disclosed:

Jul 29, 2026

CVE-2026-8143 on NVD →

The Booking Calendar plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions (including omnivo_calendar_ajax_events_settings_save and omnivo_calendar_ajax_omnivo_calendar_delete_shortcode) in versions up to, and including, 1.0.2. This makes it possible for authe...

CVSS:

7.1

Affected:

up to 1.0.2

Fix:

No patched version reported

Disclosed:

Oct 17, 2022