WP BASE Booking vulnerabilities

Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.

The WP BASE Booking plugin (wp-base-booking-of-appointments-services-and-events) is vulnerable to Blind SQL Injection due to improper neutralization of special elements in an SQL command. The vulnerability affects versions up to 6.4.0.

Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection. This issue affects WP BASE Booking: from n/a through 6.4.0.

There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.