Skip to content
OpenAdvisories

Product · Iqonic Design

WPBookit

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-1945

    WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters

    The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possib…

    Iqonic Design WPBookit Web / CMS
  • High 7.2
    CVE-2025-12135 Public exploit

    WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting

    The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the save_custome_code() function. This makes it possible for unauthent…

    Iqonic Design WPBookit Web / CMS
  • High 8.8
    CVE-2025-6057

    WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload

    The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscribe…

    Iqonic Design WPBookit Web / CMS
  • High 7.1
    CVE-2025-26910

    WordPress WPBookit plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1.

    Iqonic Design WPBookit