6.8
Medium
CVE-2026-91024 The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external…
Description
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Booking Manager 2.1 | earliest → < 2.1.21 | 2.1.21 |
Other CVEs of Booking Manager
The 4 CVEs of Booking Manager →
CVE-2026-91025
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager …
4.3
Medium
CVE-2025-10124
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode…
4.5
Medium
CVE-2023-1977
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for…
Not rated