WordPress plugin
Booking Activities security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 5 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High2
- Medium2
- Low0
All Booking Activities vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Unauthenticated PHP Object Injection ≤1.18.7.1Update to 1.18.8 | CVE-2026-97248 | |
| High8.1 | Unauthenticated PHP Object Injection ≤1.18.4Update to 1.18.5 | CVE-2026-28176 | |
| Medium5.3 | Missing Authorization ≤1.16.48.1Update to 1.17.0 | CVE-2026-39525 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤1.16.44Update to 1.16.45 | CVE-2025-67953 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.15.19Update to 1.15.20 | CVE-2024-30449 |
- High8.1Unauthenticated PHP Object Injection
≤1.18.7.1Update to 1.18.8
- High8.1Unauthenticated PHP Object Injection
≤1.18.4Update to 1.18.5
- Medium5.3Missing Authorization
≤1.16.48.1Update to 1.17.0
- Critical9.8Unauthenticated Privilege Escalation
≤1.16.44Update to 1.16.45
- Medium6.1Reflected Cross-Site Scripting
≤1.15.19Update to 1.15.20
Booking Activities: common questions
Does Booking Activities have known vulnerabilities?
Yes. VulnCrest Radar lists 5 known vulnerabilities in Booking Activities: 1 critical, 2 high, 2 medium. None are known to affect version null.
How do I check which version of Booking Activities I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Booking Activities vulnerability?
CVE-2026-97248, published Sep 28, 2026: Booking Activities <= 1.18.7.1 - Unauthenticated PHP Object Injection. Severity: High (CVSS 8.1).
Is any Booking Activities vulnerability listed in CISA KEV?
No. None of the known Booking Activities vulnerabilities is currently listed in the CISA KEV catalog.