SaasProject vulnerabilities

Products

• Booking Package 6
• Booking Package - Appointment Booking Calendar System 1

Latest SaasProject CVEs

Newest publication first

1. CVE-2026-40774 WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability

   Published 2026-06-15

   High·CVSS 7.5 EPSS 0.24%

   Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

2. CVE-2024-30516 WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability

   Published 2026-01-05

   High·CVSS 7.5 EPSS 0.27%

   Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27.

3. CVE-2023-37389 WordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerability

   Published 2024-05-17

   High·CVSS 8.8 EPSS 0.67%

   Improper Privilege Management vulnerability in SAASPROJECT Booking Package Booking Package allows Privilege Escalation.This issue affects Booking Package: from n/a through 1.5.98.

4. CVE-2023-39918 WordPress Booking Package Plugin <= 1.6.01 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-09-04

   Medium·CVSS 6.1 EPSS 0.39%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin <= 1.6.01 versions.

5. CVE-2022-0709 Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

   Published 2022-04-04

   High·CVSS 7.5 EPSS 1.6%

   The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

6. CVE-2021-20840 Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

   Published 2021-11-24

   Medium·CVSS 6.1 EPSS 1.3%

   Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.