WordPress security by component

Webba Booking

Plugin description

Webba Booking provides booking calendars, appointment scheduling, service management, and reservation forms for WordPress.

Webba Booking (webba-booking-lite) is a WordPress plugin with 11 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 7.5.

Plugin slug: webba-booking-lite

Latest vulnerability

CVE-2026-116406: Webba Booking: Missing authorization

Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 6.5.4.

PublishedOct 29, 2026

Known safe version6.5.5

Published vulnerabilities for webba-booking-lite
		Safe version
Oct 29, 2026	CVE-2026-116406 Webba Booking: Missing authorization Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 6.5.4.	6.5.5	CVE4.3
Oct 15, 2026	CVE-2026-107416 Webba Booking: A security weakness Webba Booking permits authorization bypass through a user-controlled key. The CNA vector specifies an unauthenticated attacker without victim interaction and high confidentiality impact. A caller can control a key used in an authorization decision and thereby obtain access to protected information. The export does not identify the key field, endpoint, protected object or exposed data, and does not establish booking modification or account takeover. Published affected versions: <= 6.5.2.	6.5.3	CVE7.5
Sep 30, 2026	CVE-2026-97079 Webba Booking: Broken access control Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions. Attacker-controlled object identifiers are not adequately bound to the requester's authorization. The affected objects, fields and allowed read or write operations are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 6.5.2.	6.5.2	CVE4.3
Jul 01, 2026	CVE-2026-27409 Webba Booking: A security weakness Webba Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 6.4.13.	6.4.14	CVE5.3
Dec 09, 2025	CVE-2025-66530 Webba Booking: A security weakness Webba Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Aug 20, 2025	CVE-2025-54040 Webba Booking: A security weakness Webba Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5
Aug 14, 2025	CVE-2025-54729 Webba Booking: Cross-site scripting Webba Booking is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Jul 16, 2025	CVE-2025-54036 Webba Booking: Cross-site request forgery Webba Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3
Sep 24, 2024	CVE-2024-8432 Appointment & Event Booking Calendar Plugin – Webba Booking: A security weakness Appointment & Event Booking Calendar Plugin – Webba Booking is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Dec 29, 2023	CVE-2023-51354 Appointment & Event Booking Calendar Plugin – Webba Booking: Cross-site request forgery Appointment & Event Booking Calendar Plugin – Webba Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3
Aug 22, 2022	CVE-2021-36847 Webba Booking Lite: Cross-site scripting Webba Booking Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers