WordPress plugin
Service Finder Bookings security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical5
- High3
- Medium1
- Low0
All Service Finder Bookings vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤6.2No patch available | CVE-2026-28161 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via Account Takeover <6.1Update to 6.1 | CVE-2025-6574 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via change_candidate_password ≤6.0Update to 6.1 | CVE-2025-5949 | |
| Critical9.8 | Unauthenticated Privilege Escalation via claim_business ≤6.0No patch available | CVE-2025-5948 | |
| Critical9.8 | Authentication Bypass via User Switch Cookie ≤6.0Update to 6.1 | CVE-2025-5947 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤6.0No patch available | CVE-2025-23970 | |
| Critical9.8 | Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input' ≤5.1Update to 6.0 | CVE-2025-2470 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Account Takeover ≤5.0Update to 5.1 | CVE-2024-13442 |
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤6.2No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation via Account Takeover
<6.1Update to 6.1
- High8.8Authenticated (Subscriber+) Privilege Escalation via change_candidate_password
≤6.0Update to 6.1
- Critical9.8Unauthenticated Privilege Escalation via claim_business
≤6.0No patch available
- Critical9.8Authentication Bypass via User Switch Cookie
≤6.0Update to 6.1
- Critical9.8Unauthenticated Privilege Escalation
≤6.0No patch available
- Critical9.8Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'
≤5.1Update to 6.0
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
≤5.0Update to 5.1
Service Finder Bookings: common questions
Does Service Finder Bookings have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Service Finder Bookings: 5 critical, 3 high, 1 medium. At least one is not fixed in the latest version.
How do I check which version of Service Finder Bookings I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Service Finder Bookings vulnerability?
CVE-2026-28161, published Aug 13, 2026: Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation. Severity: High (CVSS 8.8).
Is any Service Finder Bookings vulnerability listed in CISA KEV?
No. None of the known Service Finder Bookings vulnerabilities is currently listed in the CISA KEV catalog.