Vulnerability history

Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification vulnerability

SQL Injection vulnerability

Missing Authorization to Unauthenticated Booking Details Exposure vulnerability

Admin+ Stored XSS vulnerability

Missing Authorization to Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode vulnerability

Unauthenticated SQL Injection via dates_to_check vulnerability

Cross Site Scripting (XSS) vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode vulnerability

Unauthenticated Post-Confirmation Booking Manipulation vulnerability

Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode vulnerability

Admin+ Stored XSS vulnerability

Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode vulnerability

Unauthenticated SQL Injection vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

SQL Injection

Cross-Site Request Forgery (CSRF) leading to Translations Update

Insecure Deserialization/PHP Object Injection vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

SQL Injection (SQLi) vulnerability

Reflected Cross Site Scripting

SQL Injection (SQLi) vulnerability

SQL Injection

Cross-Site Request Forgery (CSRF) vulnerability