Unrated severityNVD Advisory· Published Sep 23, 2026

CVE-2026-91024

Description

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/a5472152-0b96-4fc6-af90-2f1b01811237/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000