Magepeopleteam vulnerabilities, page 3
55 vulnerabilities
Known vulnerabilities in Magepeopleteam products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.
CVE-2026-27380magepeopleteamcar rental manager+1
EPSS score0.54%
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.CVE-2026-27095magepeopleteambus ticket booking with seat reservation+1EPSS score0.56%
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.CVE-2026-27378magepeopleteamdeposits and partial payments for woocommerce+1EPSS score0.29%
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.CVE-2026-57404magepeopleteambooking and rental manager+1EPSS score0.33%
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.CVE-2026-57660magepeopleteambooking and rental manager+1EPSS score0.29%
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.CVE-2026-24942magepeopleteamwpevently+1EPSS score0.13%
Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam WpEvently mage-eventpress allows Cross Site Request Forgery.This issue affects WpEvently: from n/a through <= 5.1.1.CVE-2026-24954magepeopleteamwpevently+1EPSS score0.42%
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.CVE-2026-81762magepeopleteambooking and rental manager+1EPSS score0.30%
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.CVE-2026-32354magepeopleteamwpevently+1EPSS score0.34%
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.CVE-2026-32384magepeopleteamwpbookingly+1EPSS score0.53%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.CVE-2026-78257magepeopleteambooking and rental manager+1EPSS score0.52%
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-97251magepeopleteambus ticket booking with seat reservation+1EPSS score0.24%
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.CVE-2026-23972magepeopleteambooking and rental manager+1EPSS score0.30%
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.CVE-2026-23549magepeopleteamwpevently+1EPSS score0.45%
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.CVE-2023-4067mage-peoplebus_ticket_booking_with_seat_reservation+2EPSS score0.43%
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.