Smart Appointment & Booking
Approved changes feed: RSS · Atom
cpe:2.3:a:zealopensource:smart_appointment_&_booking:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Zealopensource (f2ce713f-fe8a-5e28-9036-8f3d8a39b1b7) |
|---|---|
| Product | Smart Appointment & Booking (ef791c1d-ed14-5f74-b681-150f7ed348ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-5693 |
vulnerable | 2026-06-08 08:07:03.989683 |
Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation
MEDIUM (5.3)
The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The nonce check uses && (AND) instead of || (OR), which means providing any value for the security parameter causes the entire check to be skipped. This makes it possible for unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID.
Published: 2026-05-12T07:48:26.131Z
Updated: 2026-05-12T12:47:37.797Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0742 |
vulnerable | 2026-06-08 07:47:13.123318 |
Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action
MEDIUM (6.4)
The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form_data AJAX action in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-02-04T08:25:32.460Z
Updated: 2026-04-08T17:19:24.185Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.