JetBooking
by WordPress
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-3496 | Hig | 0.49 | 7.5 | 0.00 | Mar 11, 2026 | The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.… | ||
| CVE-2026-65468 | Med | 0.00 | 5.3 | 0.00 | Jul 23, 2026 | Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. | ||
| CVE-2026-65466 | Med | 0.00 | 4.9 | 0.00 | Jul 23, 2026 | Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. | ||
| CVE-2026-54820 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
- risk 0.49cvss 7.5epss 0.00
The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
- risk 0.00cvss 4.9epss 0.00
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.