CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35735 – WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-35735
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11. Vulnerabilidad de autorización faltante en CodePeople WP Time Slots Booking Form. Este problema afecta al formulario de reserva de franjas horarias de WP: desde n/a hasta 1.2.11. The WP Time Slots Booking Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the data_management() function in versions up to, and including, 1.2.11. This makes it possible for unauthenticated attackers to view slot data. • https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-11-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35734 – WordPress WP Time Slots Booking Form plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-35734
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.This issue affects WP Time Slots Booking Form: from n/a through 1.2.10. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en CodePeople WP Time Slots Booking Form permite XSS Almacenado. Este problema afecta el formulario de reserva de franjas horarias de WP: desde n/a hasta 1.2.10. The WP Time Slots Booking Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33543 – WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-33543
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06. Vulnerabilidad de autorización faltante en CodePeople WP Time Slots Booking Form. Este problema afecta al formulario de reserva de franjas horarias de WP: desde n/a hasta 1.2.06. The WP Time Slots Booking Form plugin for WordPress is vulnerable to price manipulation due to insufficient server-side validation of prices in versions up to, and including, 1.2.06. This makes it possible for unauthenticated attackers to alter the price of bookings. • https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-06-broken-access-control-vulnerability?_s_id=cve • CWE-472: External Control of Assumed-Immutable Web Parameter CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41790 – WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control
https://notcve.org/view.php?id=CVE-2022-41790
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76. Vulnerabilidad de autorización faltante en CodePeople WP Time Slots Booking Form. Este problema afecta a WP Time Slots Booking Form: desde n/a hasta 1.1.76. The WP Time Slots Booking Form plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the cptslotsb_feedback function in versions up to, and including, 1.1.76. This makes it possible for authenticated attackers with subscriber access or higher to submit plugin feedback on behalf of the site owner. • https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-1-76-missing-authorization-leading-to-feedback-submission-vulnerability • CWE-862: Missing Authorization •
CVSS: 4.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23895 – WP Time Slots Booking Form <= 1.1.82 - Improper Authorization Checks
https://notcve.org/view.php?id=CVE-2023-23895
The WP Time Slots Booking Form plugin for WordPress is vulnerable to authorization bypass due to improper capability checks throughout the ~/cp-admin-int-add-booking.inc.php file in versions up to, and including, 1.1.83. This makes it possible for authenticated attackers with editor-level privileges to modify some of the plugin's settings. • CWE-285: Improper Authorization •