BookingWP vulnerabilities and threats

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.4%	CVE-2026-32557WooCommerce Appointments (WordPress plugin) · SQL Injection Critical9.3EPSS 0.4%2026-10-06CVE Database V5CVE-2026-32557 CVE-2026-32557 is a critical SQL Injection vulnerability in BookingWP WooCommerce Appointments plugin versions up to 5.3.2. It allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability can lead to high confidentiality impact and low availability impact without requiring user interaction or privileges. EPSS 0.4%Vulnerability BookingWP CWE-89	CVE Database V5	2026-10-06
High	7.5	EPSS 0.4%	CVE-2026-66462WooCommerce Appointments (WordPress plugin) · Exposure of Sensitive System Information to an Unauthorized Control Sphere High7.5EPSS 0.4%2026-08-13CVE Database V5CVE-2026-66462 Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions. EPSS 0.4%Vulnerability BookingWP CWE-497 #ghsa-vqm4-m887-hg85	CVE Database V5	2026-08-13

Page 1 of 1