murgroland WP Booking System – Booking Calendar

• CVE-2026-116557 Critical 9.1 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action 0.3%
• CVE-2026-108123 High 7.5 WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action 1.0%
• CVE-2026-109369 Medium 6.8 WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse 0.2%
• CVE-2026-109368 Medium 6.5 WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action 0.3%
• CVE-2026-111178 Medium 4.9 WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter 0.3%
• CVE-2026-107712 Medium 6.5 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter 0.3%
• CVE-2024-8797 Medium 6.1 WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting 0.5%