Threat database

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

CVE-2026-78257 is a high severity vulnerability involving PHP Object Injection due to deserialization of untrusted data in the Booking and Rental Manager product by magepeopleteam. It affects versions up to and including 2.7.5. The vulnerability allows an attacker with network access and low privileges to execute arbitrary code, causing high impact on confidentiality, integrity, and availability.

CVE-2026-73363 is a medium severity vulnerability in Taxi Booking Manager for WooCommerce versions prior to 2.0.8. It involves missing authorization controls, allowing unauthenticated users to perform actions that should require authorization. The vulnerability is classified under CWE-862 (Missing Authorization). No specific affected versions are explicitly stated beyond being before 2.0.8. There is no information about available patches or vendor advisories confirming remediation status.

Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

The Event Booking Manager for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 5.3.7. This flaw allows authenticated users with contributor-level access or higher to modify critical site-wide payment settings that affect event booking processing. The vulnerability does not impact confidentiality or availability but can lead to unauthorized changes in payment and booking configurations.

Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.

Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.

Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.

Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.