https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-47360.htmlhttps://patchthecve.com/cve/CVE-2024-47360.htmlWed, 17 Jun 2026 07:56:56 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bookingalgorithms BA Book Everything ba-book-everything.This issue affects BA Book Everything: from n/a through <= 1.6.20.https://patchthecve.com/cve/CVE-2024-8794.htmlhttps://patchthecve.com/cve/CVE-2024-8794.htmlWed, 17 Jun 2026 08:23:19 +0000MEDIUM 5.3: The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to rhttps://patchthecve.com/cve/CVE-2024-8795.htmlhttps://patchthecve.com/cve/CVE-2024-8795.htmlWed, 17 Jun 2026 08:23:19 +0000HIGH 8.8: The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's accohttps://patchthecve.com/cve/CVE-2024-32576.htmlhttps://patchthecve.com/cve/CVE-2024-32576.htmlWed, 17 Jun 2026 07:29:53 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.https://patchthecve.com/cve/CVE-2024-32598.htmlhttps://patchthecve.com/cve/CVE-2024-32598.htmlWed, 17 Jun 2026 07:29:55 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.https://patchthecve.com/cve/CVE-2024-3672.htmlhttps://patchthecve.com/cve/CVE-2024-3672.htmlWed, 17 Jun 2026 07:44:47 +0000MEDIUM 6.4: The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possiblehttps://patchthecve.com/cve/CVE-2024-32125.htmlhttps://patchthecve.com/cve/CVE-2024-32125.htmlWed, 17 Jun 2026 07:29:19 +0000HIGH 8.5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booking Algorithms BA Book Everything.This issue affects BA Book Everything: from n/a through 1.6.4.