Booking Package — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in Booking Package, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-103423	Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0' CWE-862	7.5	High	2026-10-14
CVE-2026-103425	Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute CWE-79	6.4	Medium	2026-10-14
CVE-2026-105995	Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure	-	-	2026-10-10
CVE-2026-16986	Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters	-	-	2026-08-26
CVE-2026-15335	Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter CWE-89	7.5	High	2026-07-11
CVE-2026-40774	WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability CWE-862	7.5	High	2026-06-15
CVE-2026-9851	Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action CWE-639	7.2	High	2026-06-06
CVE-2026-4911	Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter CWE-472	5.3	Medium	2026-04-28
CVE-2024-30516	WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability CWE-1284	7.5	High	2026-01-05
CVE-2024-13508	Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter CWE-79	6.1	Medium	2025-02-18
CVE-2023-37389	WordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerability CWE-269	8.8	High	2024-05-17
CVE-2023-39918	WordPress Booking Package Plugin <= 1.6.01 is vulnerable to Cross Site Scripting (XSS) CWE-79	7.1	High	2023-09-04

All 12 known CVE vulnerabilities affecting Booking Package with full Chinese analysis, references, and POCs where available.