High · 7.1 CVE-2025-58991 EUVD-2025-27403GHSA-36m6-3822-4m7c

WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Request Forgery (CSRF) Vulnerability

Published Sep 9, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Cristiano Zanca Product: WooCommerce Booking Bundle Hours Category: Web / CMS

Description

Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking Bundle Hours: from n/a through 0.7.4.

Affected products

Vendor	Product	Affected	Fixed
Cristiano Zanca	WooCommerce Booking Bundle Hours	≤ 0.7.4	—

References

https://patchstack.com/database/wordpress/plugin/woo-booking-bundle-hours/vulnerability/wordpress-woocommerce-booking-bundle-hours-plugin-0-7-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry