CVE-2026-61951

CRITICAL9.8

Published 2026-07-23 · Updated 2026-07-23 · Source audit@patchstack.com

Description

Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-266

References

https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-3-privilege-escalation-vulnerability?_s_id=cve

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-65907
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
2026-07-23 · score 9.1
CVE-2026-65606
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.
2026-07-23 · score 9.6
CVE-2026-65605
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
2026-07-23 · score 9.6
CVE-2026-65471
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
2026-07-23 · score 9.6
CVE-2026-65461
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
2026-07-23 · score 9.1