murgroland WP Booking System – Booking Calendar
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-116557 | ≤ 2.1.0.5 | WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJ… | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-108123 | ≤ 2.1.0.3 | WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action | HIGH 7.5 | 1.0 % | ||
| CVE-2026-109369 | ≤ 2.1.0.3 | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter … | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-109368 | ≤ 2.1.0.3 | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calen… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-111178 | ≤ 2.1.0.1 | WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-107712 | ≤ 2.1.0.1 | WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-8797 | ≤ 2.0.19.8 | WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting | MEDIUM 6.1 | 0.5 % |