What’s Vulnerable › Products

TrueBooker vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your TrueBooker version is affected

Latest TrueBooker vulnerabilities

• CVE-2026-94231 — TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification (CVSS 5.3)
• CVE-2026-94230 — TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions (CVSS 5.3)
• CVE-2026-94229 — TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter (CVSS 5.3)
• CVE-2026-94228 — TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data (CVSS 5.3)
• CVE-2026-39798 — WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability (CVSS 6.5)
• CVE-2026-73347 — WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2026-18779 — TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked (CVSS 5.3)
• CVE-2026-18778 — TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions (CVSS 5.3)
• CVE-2026-18777 — TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status (CVSS 5.3)
• CVE-2026-18776 — TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions (CVSS 9.8)
• CVE-2026-14545 — TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset (CVSS 9.8)
• CVE-2026-61951 — WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2026-61950 — WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability (CVSS 9.3)
• CVE-2026-48881 — WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability (CVSS 9.1)
• CVE-2026-39663 — WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-67581 — WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-47543 — WordPress TrueBooker plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
• CVE-2024-6925 — TrueBooker < 1.0.3 - Settings Update via CSRF (CVSS 4.3)
• CVE-2024-6924 — TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi (CVSS 9.8)