Booking Package

Information

Software Type	Plugin
Software Slug	booking-package (view on wordpress.org)
Software Status	Active
Software Author	masaakitanaka
Software Website	saasproject.net
Software Downloads	1,178,949
Software Active Installs	10,000
Software Record Last Updated	July 21, 2026

10 Vulnerabilities

Submit a Vulnerability

Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter

7.5

CVE-2026-15335

Jul 10, 2026

Researcher: PRISM

Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

7.2

CVE-2026-9851

Jun 5, 2026

Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)

Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

5.3

CVE-2026-4911

Apr 27, 2026

Researcher: momopon1415

Booking Package <= 1.7.06 - Missing Authorization

5.3

CVE-2026-40774

Apr 21, 2026

Researcher: Skoobi

Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

6.1

CVE-2024-13508

Feb 18, 2025

Researcher: Krzysztof Zając

Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

5.3

CVE-2024-30516

Mar 28, 2024

Researcher: Abdi Pranata

Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

6.1

CVE-2023-39918

Aug 7, 2023

Researcher: Truoc Phan

Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

9.8

CVE-2023-37389

Jul 5, 2023

Researcher: Rafie Muhammad

Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure

7.5

CVE-2022-0709

Mar 9, 2022

Researcher: Huli, Cymetrics

Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

6.1

CVE-2021-20840

Nov 10, 2021

Researcher: Gen Sato

Title	Status	CVE ID	CVSS	Researchers	Date
Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter	Patched	CVE-2026-15335	7.5	PRISM	July 10, 2026
Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action	Patched	CVE-2026-9851	7.2	Md. Moniruzzaman Prodhan (NomanProdhan)	June 5, 2026
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter	Patched	CVE-2026-4911	5.3	momopon1415	April 27, 2026
Booking Package <= 1.7.06 - Missing Authorization	Patched	CVE-2026-40774	5.3	Skoobi	April 21, 2026
Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter	Patched	CVE-2024-13508	6.1	Krzysztof Zając	February 18, 2025
Booking Package <= 1.6.27 - Unauthenticated Price Manipulation	Patched	CVE-2024-30516	5.3	Abdi Pranata	March 28, 2024
Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'	Patched	CVE-2023-39918	6.1	Truoc Phan	August 7, 2023
Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset	Patched	CVE-2023-37389	9.8	Rafie Muhammad	July 5, 2023
Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure	Patched	CVE-2022-0709	7.5	Huli, Cymetrics	March 9, 2022
Booking Package <= 1.5.10 - Reflected Cross-Site Scripting	Patched	CVE-2021-20840	6.1	Gen Sato	November 10, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation