Plugin security history

Booking Package Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with Booking Package, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

1Critical

3High

6Medium

0Low

0Informational

10Patched records

0Currently marked unpatched

2021-11-10First disclosure

2026-07-10Latest disclosure

10 of 10CVE coverage

Use this history

Check and watch Booking Package.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Booking Package

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2022	1	1 records
2023	2	2 records
2024	1	1 records
2025	1	1 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	1	10%
High	3	30%
Medium	6	60%

Vulnerability-Type Breakdown

Cross-Site Scripting

3 records30%

First: 2021. Latest: 2025.

Missing Authorization

3 records30%

First: 2023. Latest: 2026.

Other

2 records20%

First: 2024. Latest: 2026.

Information Disclosure

1 record10%

First: 2022. Latest: 2022.

SQL Injection

1 record10%

First: 2026. Latest: 2026.

Patch Status

Patched: 10
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.7.21
1.7.17
1.7.07
1.6.73
1.6.29
1.6.02
1.5.99
1.5.29
1.5.11

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.7.20`	Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter	July 10, 2026	1.7.21	High
`*-1.7.16`	Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action	June 5, 2026	1.7.17	High
`*-1.7.06`	Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter	April 27, 2026	1.7.07	Medium
`*-1.7.06`	Booking Package <= 1.7.06 - Missing Authorization	April 21, 2026	1.7.07	Medium
`*-1.6.72`	Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter	February 18, 2025	1.6.73	Medium
`*-1.6.27`	Booking Package <= 1.6.27 - Unauthenticated Price Manipulation	March 28, 2024	1.6.29	Medium
`*-1.6.01`	Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'	August 7, 2023	1.6.02	Medium
`[*, 1.5.99)`	Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset	July 5, 2023	1.5.99	Critical
`[*, 1.5.29)`	Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure	March 9, 2022	1.5.29	High
`[*, 1.5.11)`	Booking Package <= 1.5.10 - Reflected Cross-Site Scripting	November 10, 2021	1.5.11	Medium

Selected source records

Latest Records

HighCVE-2026-15335

Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter

Published: July 10, 2026

Affected versions: *-1.7.20
Patched versions: 1.7.21

Original Wordfence record

HighCVE-2026-9851

Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

Published: June 5, 2026

Affected versions: *-1.7.16
Patched versions: 1.7.17

Original Wordfence record

MediumCVE-2026-4911

Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter

Published: April 27, 2026

Affected versions: *-1.7.06
Patched versions: 1.7.07

Original Wordfence record

MediumCVE-2026-40774

Booking Package <= 1.7.06 - Missing Authorization

Published: April 21, 2026

Affected versions: *-1.7.06
Patched versions: 1.7.07

Original Wordfence record

MediumCVE-2024-13508

Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

Published: February 18, 2025

Affected versions: *-1.6.72
Patched versions: 1.6.73

Original Wordfence record

MediumCVE-2024-30516

Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

Published: March 28, 2024

Affected versions: *-1.6.27
Patched versions: 1.6.29

Original Wordfence record

MediumCVE-2023-39918

Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

Published: August 7, 2023

Affected versions: *-1.6.01
Patched versions: 1.6.02

Original Wordfence record

CriticalCVE-2023-37389

Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

Published: July 5, 2023

Affected versions: [*, 1.5.99)
Patched versions: 1.5.99

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-37389

Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset

Published: July 5, 2023

Affected versions: [*, 1.5.99)
Patched versions: 1.5.99

Original Wordfence record

HighCVE-2026-15335

Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter

Published: July 10, 2026

Affected versions: *-1.7.20
Patched versions: 1.7.21

Original Wordfence record

HighCVE-2022-0709

Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure

Published: March 9, 2022

Affected versions: [*, 1.5.29)
Patched versions: 1.5.29

Original Wordfence record

HighCVE-2026-9851

Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

Published: June 5, 2026

Affected versions: *-1.7.16
Patched versions: 1.7.17

Original Wordfence record

MediumCVE-2024-13508

Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

Published: February 18, 2025

Affected versions: *-1.6.72
Patched versions: 1.6.73

Original Wordfence record

MediumCVE-2021-20840

Booking Package <= 1.5.10 - Reflected Cross-Site Scripting

Published: November 10, 2021

Affected versions: [*, 1.5.11)
Patched versions: 1.5.11

Original Wordfence record

MediumCVE-2023-39918

Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'

Published: August 7, 2023

Affected versions: *-1.6.01
Patched versions: 1.6.02

Original Wordfence record

MediumCVE-2026-40774

Booking Package <= 1.7.06 - Missing Authorization

Published: April 21, 2026

Affected versions: *-1.7.06
Patched versions: 1.7.07

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory