WordPress plugin
TrueBooker – Appointment Booking and Scheduler System security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 25 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical7
- High4
- Medium14
- Low0
All TrueBooker – Appointment Booking and Scheduler System vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | 1.2.9 - Unauthenticated Information Exposure 1.1.9 – 1.2.9Update to 1.3.0 | CVE-2026-94229 | |
| Medium5.3 | 1.2.9 - Missing Authorization 1.1.9 – 1.2.9Update to 1.3.0 | CVE-2026-94230 | |
| Medium5.3 | 1.2.9 - Missing Authorization 1.1.9 – 1.2.9Update to 1.3.0 | CVE-2026-94231 | |
| Medium5.3 | 1.2.9 - Missing Authorization 1.1.9 – 1.2.9Update to 1.3.0 | CVE-2026-94228 | |
| Medium5.3 | Missing Authorization to Unauthenticated Settings Update ≤1.2.9Update to 1.3.0 | CVE-2026-39798 | |
| Critical9.8 | Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action ≤1.2.3Update to 1.2.4 | CVE-2026-14349 | |
| Medium5.3 | Missing Authorization <1.2.7Update to 1.2.7 | CVE-2026-18777 | |
| High7.3 | Unauthenticated Privilege Escalation <1.2.7Update to 1.2.7 | CVE-2026-18776 | |
| Medium5.3 | Unauthenticated Information Exposure <1.2.7Update to 1.2.7 | CVE-2026-18778 | |
| Medium5.3 | Missing Authorization <1.2.7Update to 1.2.7 | CVE-2026-18779 | |
| High7.3 | Unauthenticated Privilege Escalation ≤1.2.6Update to 1.2.7 | CVE-2026-73347 | |
| Critical9.8 | Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter ≤1.2.6Update to 1.2.7 | CVE-2026-18315 | |
| Critical9.8 | Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter ≤1.2.6Update to 1.2.7 | CVE-2026-16142 | |
| Critical9.8 | Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' ≤1.2.3Update to 1.2.4 | CVE-2026-14364 | |
| Critical9.8 | Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' ≤1.2.3Update to 1.2.4 | CVE-2026-14365 | |
| High7.5 | Unauthenticated SQL Injection ≤1.2.2Update to 1.2.3 | CVE-2026-13161 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤1.2.3Update to 1.2.4 | CVE-2026-61951 | |
| High7.5 | Unauthenticated SQL Injection ≤1.2.3Update to 1.2.4 | CVE-2026-61950 | |
| Medium5.3 | Missing Authorization ≤1.1.9Update to 1.2.0 | CVE-2026-48881 | |
| Medium5.3 | Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files ≤1.1.4Update to 1.1.5 | CVE-2026-1797 | |
| Medium5.3 | Missing Authorization ≤1.1.6Update to 1.1.7 | CVE-2026-39663 | |
| Medium5.3 | Missing Authorization ≤1.1.0Update to 1.1.1 | CVE-2025-67581 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.0.7Update to 1.0.8 | CVE-2025-47543 | |
| Medium4.3 | Cross-Site Request Forgery to Settings Update ≤1.0.2Update to 1.0.3 | CVE-2024-6925 | |
| Critical10.0 | Unauthenticated SQL Injection ≤1.0.3Update to 1.0.4 | CVE-2024-6924 |
- Medium5.31.2.9 - Unauthenticated Information Exposure
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.31.2.9 - Missing Authorization
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.31.2.9 - Missing Authorization
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.31.2.9 - Missing Authorization
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.3Missing Authorization to Unauthenticated Settings Update
≤1.2.9Update to 1.3.0
- Critical9.8Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization
<1.2.7Update to 1.2.7
- High7.3Unauthenticated Privilege Escalation
<1.2.7Update to 1.2.7
- Medium5.3Unauthenticated Information Exposure
<1.2.7Update to 1.2.7
- Medium5.3Missing Authorization
<1.2.7Update to 1.2.7
- High7.3Unauthenticated Privilege Escalation
≤1.2.6Update to 1.2.7
- Critical9.8Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
≤1.2.6Update to 1.2.7
- Critical9.8Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
≤1.2.6Update to 1.2.7
- Critical9.8Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
≤1.2.3Update to 1.2.4
- Critical9.8Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
≤1.2.3Update to 1.2.4
- High7.5Unauthenticated SQL Injection
≤1.2.2Update to 1.2.3
- Critical9.8Unauthenticated Privilege Escalation
≤1.2.3Update to 1.2.4
- High7.5Unauthenticated SQL Injection
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization
≤1.1.9Update to 1.2.0
- Medium5.3Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
≤1.1.4Update to 1.1.5
- Medium5.3Missing Authorization
≤1.1.6Update to 1.1.7
- Medium5.3Missing Authorization
≤1.1.0Update to 1.1.1
- Medium4.3Cross-Site Request Forgery
≤1.0.7Update to 1.0.8
- Medium4.3Cross-Site Request Forgery to Settings Update
≤1.0.2Update to 1.0.3
- Critical10.0Unauthenticated SQL Injection
≤1.0.3Update to 1.0.4
TrueBooker – Appointment Booking and Scheduler System: common questions
Does TrueBooker – Appointment Booking and Scheduler System have known vulnerabilities?
Yes. VulnCrest Radar lists 25 known vulnerabilities in TrueBooker – Appointment Booking and Scheduler System: 7 critical, 4 high, 14 medium. None are known to affect version null.
How do I check which version of TrueBooker – Appointment Booking and Scheduler System I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent TrueBooker – Appointment Booking and Scheduler System vulnerability?
CVE-2026-94229, published Oct 16, 2026: TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any TrueBooker – Appointment Booking and Scheduler System vulnerability listed in CISA KEV?
No. None of the known TrueBooker – Appointment Booking and Scheduler System vulnerabilities is currently listed in the CISA KEV catalog.