Threat database

CVE-2026-73363 is a medium severity vulnerability in Taxi Booking Manager for WooCommerce versions prior to 2.0.8. It involves missing authorization controls, allowing unauthenticated users to perform actions that should require authorization. The vulnerability is classified under CWE-862 (Missing Authorization). No specific affected versions are explicitly stated beyond being before 2.0.8. There is no information about available patches or vendor advisories confirming remediation status.

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

The Event Booking Manager for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 5.3.7. This flaw allows authenticated users with contributor-level access or higher to modify critical site-wide payment settings that affect event booking processing. The vulnerability does not impact confidentiality or availability but can lead to unauthorized changes in payment and booking configurations.

Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

CVE-2026-45441 is a high-severity vulnerability in Magepeople inc.'s WpEvently plugin affecting versions up to and including 5.3.3. It involves improper validation of specified quantity in input, classified under CWE-1284. The vulnerability can be exploited without authentication and does not impact confidentiality or availability but can cause a high integrity impact. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.

Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through 4.1.2.

Background Image Cropper version 1.2 for WordPress contains a critical remote code execution vulnerability. Unauthenticated attackers can upload arbitrary files, including PHP scripts, via the ups.php endpoint. This allows execution of arbitrary code on the affected server. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor. Users of version 1.2 should exercise caution and monitor vendor advisories for updates.

CVE-2026-42500 is a medium severity vulnerability in the golang.org/x/image/bmp package where decoding a paletted BMP file with an out-of-range palette index causes a panic due to improper validation of the array index. This results in a denial of service condition by crashing the image decoding process. There is no indication of confidentiality, integrity, or privilege impact. No patch or official remediation has been confirmed yet.

ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.