Unknown Rox Appointment Booking vulnerabilities

5 CVEs affecting Unknown Rox Appointment Booking, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87907, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-87907, published 2026-09-16. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated…
CVE-2026-87896, published 2026-09-16. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to…
CVE-2026-87891, published 2026-09-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the…
CVE-2026-87892, published 2026-09-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing…
CVE-2026-87894, published 2026-09-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a…