CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36852 – WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2021-36852
02 Aug 2022 — Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin ThimPress WP Hotel Booking versiones anteriores a 1.10.5, incluyéndola, en WordPress. The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.5 due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to trigger action... • https://patchstack.com/database/vulnerability/wp-hotel-booking/wordpress-wp-hotel-booking-plugin-1-10-5-cross-site-request-forgery-csrf-vulnerability • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 78%CPEs: 1EXPL: 1CVE-2020-29047 – WP Hotel Booking <= 1.10.3 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-29047
08 Dec 2020 — The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php. El plugin wp-hotel-booking versiones hasta 1.10.2 para WordPress, permite a atacantes remotos ejecutar código arbitrario debido a una operación de deserializar en la cookie thimpress_hotel_booking_1 en la carga en el archivo includes/classwphb-sessions.php The wp-hotel-booking plugin... • https://appcheck-ng.com/cve-2020-29047 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36757 – WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass
https://notcve.org/view.php?id=CVE-2020-36757
16 Sep 2020 — The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthenticated attackers to add an order item via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks • CWE-352: Cross-Site Request Forgery (CSRF) •