WP Booking System vulnerabilities

The WP Booking System plugin by Roland Murg up to 2.1.0.6 does not properly neutralize input during web page generation, allowing a Reflected XSS attack. The issue affects versions from n/a through 2.1.0.6.

The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.

The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.