Truebooker

WordPress plugin · truebooker · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Truebooker on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 9.8	TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions CVE.org	>=0, <1.2.7	v1.2.7	CVE-2026-18776	Aug 19, 2026
CRITICAL CVSS 9.8	TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset CVE.org	>=0, <1.2.4	v1.2.4	CVE-2026-14545	Jul 28, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions CVE.org	>=1.1.9, <1.3.0	v1.3.0	CVE-2026-94230	Oct 19, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification CVE.org	>=1.1.9, <1.3.0	v1.3.0	CVE-2026-94231	Oct 19, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter CVE.org	>=1.1.9, <1.3.0	v1.3.0	CVE-2026-94229	Oct 19, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data CVE.org	>=1.1.9, <1.3.0	v1.3.0	CVE-2026-94228	Oct 19, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked CVE.org	>=0, <1.2.7	v1.2.7	CVE-2026-18779	Aug 19, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status CVE.org	>=0, <1.2.7	v1.2.7	CVE-2026-18777	Aug 19, 2026
MEDIUM CVSS 5.3	TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions CVE.org	>=0, <1.2.7	v1.2.7	CVE-2026-18778	Aug 19, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.