WordPress security by component

Taxi Booking Manager for WooCommerce

Plugin description

Taxi Booking Manager for WooCommerce adds taxi booking, vehicle, route, and fare management features to WooCommerce websites.

Taxi Booking Manager for WooCommerce (ecab-taxi-booking-manager) is a WordPress plugin with 12 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.8.

Plugin slug: ecab-taxi-booking-manager

Latest vulnerability

CVE-2026-114181: Taxi Booking Manager for WooCommerce: Missing authorization

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.1.6.

PublishedOct 29, 2026

Known safe version2.1.7

Published vulnerabilities for ecab-taxi-booking-manager
		Safe version
Oct 29, 2026	CVE-2026-114181 Taxi Booking Manager for WooCommerce: Missing authorization Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.1.6.	2.1.7	CVE5.3
Oct 05, 2026	CVE-2026-103351 Taxi Booking Manager for WooCommerce: Quantity validation failure No attacker login is required by the supplied CVSS vector. Attacker-controlled numerical input can influence a calculation without adequate validation, producing an unintended result. The vector reports limited integrity impact without victim interaction; the export does not identify the affected quantity or establish the exact financial effect. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 2.1.1. The authoritative export identifies 2.1.2 as fixed for this CVE.	2.1.2	CVE5.3
Sep 22, 2026	CVE-2026-93928 Taxi Booking Manager has an unauthenticated authentication-bypass path The affected authentication boundary can be bypassed through an alternate path or channel. The CNA vector requires no attacker account and assigns low confidentiality, integrity and availability impacts. The endpoint, input, bypass mechanism, resulting identity and accessible actions are unspecified; administrator account takeover is not established. Affected versions: n/a to < 2.0.8. Confirmed fixed release: 2.0.8.	2.0.8	CVE7.3
Aug 19, 2026	CVE-2026-73363 Taxi Booking Manager for WooCommerce: Broken access control Taxi Booking Manager for WooCommerce is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 2.0.8.	2.0.8	CVE6.5
Aug 13, 2026	CVE-2026-27345 Taxi Booking Manager for WooCommerce: Broken access control Taxi Booking Manager for WooCommerce is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.0.3.	2.0.5	CVE7.5
May 26, 2026	CVE-2026-25426 Taxi Booking Manager for WooCommerce: A security weakness Taxi Booking Manager for WooCommerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.0.1.	2.0.2	CVE5.3
Apr 23, 2026	CVE-2026-28040 Taxi Booking Manager for WooCommerce: Cross-site scripting Taxi Booking Manager for WooCommerce is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.0.0.	2.0.1	CVE6.5
Aug 20, 2025	CVE-2025-54713 Taxi Booking Manager for WooCommerce: Privilege escalation or authentication bypass Taxi Booking Manager for WooCommerce is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE9.8
Aug 16, 2025	CVE-2025-8898 Taxi Booking Manager for Woocommerce \| E-cab: Privilege escalation or authentication bypass Taxi Booking Manager for Woocommerce \| E-cab is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE9.8
Mar 27, 2025	CVE-2025-30839 Taxi Booking Manager for WooCommerce: A security weakness Taxi Booking Manager for WooCommerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Feb 03, 2025	CVE-2025-24661 Taxi Booking Manager for WooCommerce: Code execution Taxi Booking Manager for WooCommerce is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8
Aug 29, 2024	CVE-2024-43986 Taxi Booking Manager for WooCommerce: Cross-site scripting Taxi Booking Manager for WooCommerce is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers