Service Booking Manager Vulnerabilities

The Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom...

CVSS:

6.4

Affected:

up to 1.3.2

Fixed in:

1.4.0

Disclosed:

Aug 10, 2026

CVE-2026-66687 on NVD →

The Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with contributor-level access a...

CVSS:

4.3

Affected:

up to 1.2.9

Fixed in:

1.3.0

Disclosed:

May 26, 2026

CVE-2026-25444 on NVD →

[en] Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

Affected:

up to 1.3.0

Fixed in:

1.3.0

Disclosed:

May 26, 2026

CVE-2026-25444 on NVD →

The Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with author-level access and ab...

CVSS:

4.3

Affected:

up to 1.2.9

Fixed in:

1.3.0

Disclosed:

May 20, 2026

CVE-2026-27405 on NVD →

[en] Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

Affected:

up to 1.3.0

Fixed in:

1.3.0

Disclosed:

May 20, 2026

CVE-2026-27405 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.

Affected:

up to 1.3.0

Fixed in:

1.3.0

Disclosed:

Mar 13, 2026

CVE-2026-32384 on NVD →

The WpBookingly plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Th...

CVSS:

7.5

Affected:

up to 1.2.9

Fixed in:

1.3.0

Disclosed:

Feb 18, 2026

CVE-2026-32384 on NVD →

Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly service-booking-manager allows Object Injection.This issue affects WpBookingly: from n/a through <= 1.3.0.

Affected:

up to 1.3.1

Fix:

No patched version reported

Disclosed:

Apr 11, 2025

CVE-2025-32607 on NVD →

The WpBookingly plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.3.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via...

CVSS:

9.8

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

Apr 10, 2025

CVE-2025-32607 on NVD →