Unknown Booking Package vulnerabilities

2 CVEs affecting Unknown Booking Package, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105995, published 2026-10-10.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-105995, published 2026-10-10. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal…
• CVE-2026-16986, published 2026-08-26. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request…