What’s Vulnerable › Products

iqonicdesign WPBookit vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your iqonicdesign WPBookit version is affected

Latest iqonicdesign WPBookit vulnerabilities

• CVE-2026-1980 — WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure (CVSS 5.3)
• CVE-2026-1945 — WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters (CVSS 7.2)
• CVE-2025-12135 — WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
• CVE-2025-7852 — WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function (CVSS 9.8)
• CVE-2025-6058 — WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
• CVE-2025-6057 — WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
• CVE-2025-3811 — WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update (CVSS 9.8)
• CVE-2025-3810 — WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8)
• CVE-2025-32254 — WordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-26910 — WordPress WPBookit plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.1)
• CVE-2025-0357 — WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
• CVE-2024-10215 — WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change (CVSS 9.8)
• CVE-2024-54280 — WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability (CVSS 9.8)