Booktics
by WordPress
Source repositories
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-28002 | Hig | 0.55 | 8.5 | 0.00 | Aug 13, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22. | ||
| CVE-2026-62135 | Med | 0.34 | 5.3 | 0.00 | Sep 11, 2026 | Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. | ||
| CVE-2026-11446 | Med | 0.34 | 5.3 | 0.00 | Sep 11, 2026 | The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST… | ||
| CVE-2026-39585 | Med | 0.34 | 5.3 | 0.00 | Apr 8, 2026 | Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16. | ||
| CVE-2026-1920 | Med | 0.27 | 5.3 | 0.00 | Mar 10, 2026 | The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and… | ||
| CVE-2026-1919 | Med | 0.27 | 5.3 | 0.00 | Mar 10, 2026 | The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for… | ||
| CVE-2026-57621 | Cri | 0.00 | 9.8 | 0.01 | Jul 2, 2026 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. |
- risk 0.55cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
- risk 0.34cvss 5.3epss 0.00
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST…
- risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.
- risk 0.27cvss 5.3epss 0.00
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and…
- risk 0.27cvss 5.3epss 0.00
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for…
- risk 0.00cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.