Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · rox-appointment-booking
Rox Appointment Booking
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 16, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoints that return booking service and category recordsCVE-2026-87907 · fixed in 1.2.8 · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
Sep 16, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoint that returns booking agent (staff) recordsCVE-2026-87896 · fixed in 1.2.8 · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.
Sep 12, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoint that returns a booking's confirmation detailsCVE-2026-87894 · fixed in 1.2.3 · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Sep 12, 2026Rox Appointment Booking: Does not verify the order total or the selected payment method against its own server-side pricingCVE-2026-87892 · fixed in 1.2.0 · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
Sep 12, 2026Rox Appointment Booking: Does not perform any capability or authorization checkCVE-2026-87891 · fixed in 1.2.0 · reported by WPScanMedium 6.5
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.