xtreeme vulnerabilities

Products

• Planyo online reservation system 2

Latest xtreeme CVEs

Newest publication first

1. CVE-2026-3576 Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter

   Published 2026-07-11

   High·CVSS 7.2 EPSS 8.8% Framework module Public exploit

   The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or...

2. CVE-2025-31811 WordPress Planyo online reservation system plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-01

   Medium·CVSS 6.5 EPSS 0.37%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through <= 3.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.