https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T09:25:00.657018+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331573 EUVD-2026-331573 2026-10-09T09:25:00.702788+00:00 EUVD-2026-331573 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11823 fkie_cve-2026-11823 2026-10-09T09:25:00.702831+00:00

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

 https://cve.radiocsirt.org/vuln/ghsa-6qfc-c5qp-6g6q GHSA-6qfc-c5qp-6g6q 2026-10-09T09:25:00.702884+00:00

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.