Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Booking ManagerWpTravellyTaxi Booking Manager for WooCommerceWpBookinglyDesignThemes Booking ManagerMultipurpose Ticket Booking Manager
Plugin · booking-manager
Booking Manager
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 23, 2026Booking Manager: Does not verify that a request to modify a user's Booking Manager WordPress plugin before 2CVE-2026-91025 · fixed in 2.1.21 · reported by WPScanMedium 4.3
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
Sep 23, 2026Booking Manager: Does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL queryCVE-2026-91024 · fixed in 2.1.21 · reported by WPScanMedium 6.8
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
May 27, 2026Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42751 · affects up to 2.1.18 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.18.
Nov 13, 2025Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64275 · affects up to 2.1.17 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.17.
Oct 10, 2025Booking Manager: Registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privilegesCVE-2025-10124 · fixed in 2.1.15 · reported by WPScanMedium 4.5
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
Dec 28, 2023Booking Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50840 · affects up to 2.1.5 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Booking Manager: from n/a through 2.1.5.
Aug 16, 2023Booking Manager: Does not validate URLs input in it's admin panel or in shortcodes for showing events from a remoteCVE-2023-1977 · fixed in 2.0.29 · reported by WPScanHigh 8.8
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.