CVE-2023-1977: vulnerability in Booking Manager
Booking Manager < 2.0.29 - Subscriber+ SSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.8%
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
Affected products
Unknown · Booking ManagerRelated CVEs — Booking Manager
In the same product, most dangerous first.
CVE-2026-91024MEDIUMBooking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)EPSS 0.4%CVE-2025-10124MEDIUMBooking Manager < 2.1.15 - Contributor+ Booking DeletionEPSS 0.3%CVE-2026-91025MEDIUMBooking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOREPSS 0.3%