Booking Manager vulnerabilities

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access and above can create or overwrite the plugin's per-user settings on arbitrary users, including administrators.

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access and above can perform SQL injection attacks by importing a feed they control.

The Booking Manager plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Manager versions from n/a through <= 2.1.17.