JetBooking
by WordPress
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-3496 | Hig | 0.49 | 7.5 | 0.00 | Mar 11, 2026 | The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.… | ||
| CVE-2026-65468 | 0.00 | — | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. | |||
| CVE-2026-65466 | 0.00 | — | 0.00 | Jul 23, 2026 | Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. | |||
| CVE-2026-54820 | 0.00 | — | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
- risk 0.49cvss 7.5epss 0.00
The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
- CVE-2026-65468Jul 23, 2026risk 0.00cvss —epss 0.00
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
- CVE-2026-65466Jul 23, 2026risk 0.00cvss —epss 0.00
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
- CVE-2026-54820Jun 26, 2026risk 0.00cvss —epss 0.00
Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.