Skip to content
OpenAdvisories

Vendor

masaakitanaka

6 known vulnerabilities.

Products

Booking Package 6
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-103425

    Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

    The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…

    masaakitanaka Booking Package Web / CMS
  • Medium 5.3
    CVE-2026-4911

    Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

    The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without valid…

    masaakitanaka Booking Package Web / CMS
  • Medium 6.1
    CVE-2024-13508

    Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

    The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat…

    masaakitanaka Booking Package Web / CMS