Unknown Appointment Booking Plugin vulnerabilities

5 CVEs affecting Unknown Appointment Booking Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105198, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15250, published 2026-07-30. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated…
CVE-2026-105198, published 2026-10-08. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary,…
CVE-2026-105197, published 2026-10-08. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated…
CVE-2026-11866, published 2026-07-16. Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days. The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform…
CVE-2026-105196, published 2026-10-08. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the…