Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 19 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 9 disclosures.

The most common weakness is Missing Authorization, behind 9 of the records (47%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

Every one of the 19 issues recorded for Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment has a vendor fix available, so running the current release closes all known holes.

15 independent researchers contributed these findings, most of them (4) reported by LVT-tholv2k. Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

01234567891013.06.2022Today13.06.20234.4Booking and Rental Manager <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 13.06.202310.01.20256.1Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin <= 2.2.1 - Reflected Cross-Site Scripting CVSS 6.1 · 10.01.202515.01.20255.3Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress <= 2.2.1 - Missing Authorization CVSS 5.3 · 15.01.202523.02.20258.8Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.2.6 - Authenticated (Contributor+) PHP Object Injection CVSS 8.8 · 23.02.202511.04.20258.8Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 11.04.202517.04.20255.3Booking and Rental Manager <= 2.2.8 - Missing Authorization CVSS 5.3 · 17.04.202518.04.20255.3Booking and Rental Manager <= 2.3.6 - Missing Authorization CVSS 5.3 · 18.04.202522.05.20255.3Booking and Rental Manager <= 2.3.8 - Missing Authorization CVSS 5.3 · 22.05.202520.09.20257.5Booking and Rental Manager <= 2.5.4 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 20.09.202501.11.20257.2Booking and Rental Manager <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 01.11.202509.02.20267.5Booking and Rental Manager <= 2.5.9 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 09.02.202623.03.20264.3Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.6.0 - Missing Authorization CVSS 4.3 · 23.03.202626.06.20265.3Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization CVSS 5.3 · 26.06.202608.07.20265.3Booking and Rental Manager <= 2.6.9 - Missing Authorization CVSS 5.3 · 08.07.202623.07.20265.3Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.2 - Unauthenticated Price Maniputlation CVSS 5.3 · 23.07.202624.08.20265.3Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Missing Authorization CVSS 5.3 · 24.08.202625.08.20267.5Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 25.08.202628.08.20264.3Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.6 - Missing Authorization CVSS 4.3 · 28.08.202603.09.20266.4Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 03.09.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

19

Get automatic notifications for all Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-27011

Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

19 records
2026-09-03 00:00CVE-2026-85303
6.4
Medium
sungbyeongchanYes
2026-08-28 00:00CVE-2026-81762
4.3
Medium
sungbyeongchanYes
2026-08-25 00:00CVE-2026-78257
7.5
High
darooYes
2026-08-24 00:00CVE-2026-78258
5.3
Medium
BaoYes
2026-07-23 00:00CVE-2026-59532
5.3
Medium
dodoh4tYes
2026-07-08 00:00CVE-2026-57404
5.3
Medium
hhhaiYes
2026-06-26 00:00CVE-2026-57660
5.3
Medium
Averon AverenkovYes
2026-03-23 00:00CVE-2026-23972
4.3
Medium
PPzzAArrYes
2026-02-09 00:00CVE-2025-69328
7.5
High
Phat RiOYes
2025-11-01 00:00CVE-2025-49904
7.2
High
Ryan NovotnyYes
Showing 1–10 of 19 reports
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment banner
Latestv2.7.8

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment

magepeopleteam

Author

magepeopleteam

4.4(33)
88/100
Last Updated
2026-09-03 (10d ago)
Active Installs
1,000+
Downloads
73,459
Requires WP
5.3+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2022-06-13 (4y ago)

Booking and Rental Manager for WooCommerce helps you build a rental booking system inside WordPress and WooCommerce. Create single-day, multi-day, appointment, resort, equipment, dress, and multi-item rentals, then accept bookings through the WooCommerce checkout flow. Use it for car rentals, bike rentals, equipment rentals, dress rentals, appointment booking, resort booking, vacation rentals, parking, boat rentals, sports kits, office spaces, and other rental businesses that need date-based booking, pricing, inventory, and order management. Demo and documentation Frontend live demo Documentation Pro version What you can build Car and bike rental websites Equipment and tool rental websites Dress and costume rental websites Appointment booking systems Resort and room booking websites Vacation rental and holiday rental websites Boat, sports kit, parking, and office space rental websites Multi-item rental catalogs with separate item quantities Key free features WooCommerce-based rental checkout and payment flow Single-day and multi-day rental booking Multi-item rental support Appointment and resort booking support Hourly, daily, weekly, monthly, day-wise, day-long, and day-night pricing options Pickup and drop-off location settings Inventory and availability controls Extra services and add-ons Dress size configuration Related rental items and highlighted features Rental galleries, sliders, and multiple list layouts Frontend customer booking dashboard Order list with booking details Tax settings and WooCommerce payment gateway support Responsive layouts and multilingual translation support Shortcodes for rental lists and single-item booking forms Pro features Booking calendar with order details Reports with order details CSV export for reports PDF booking receipts Booking-related email features View Pro version Video overview Shortcodes Show rental items: [rent-list type='' style='grid' show='' columns='' left-filter='yes/no' category='' order='DESC'] Show only single-day bike/car rentals: [rent-list type='bike_car_sd'] Show grid-style rental list: [rent-list style='grid' left-filter='yes/no'] Show list-style rental list: [rent-list style='list' left-filter='yes/no'] Show six rental items: [rent-list show='6'] Show rental items in ascending order: [rent-list order='ASC'] Show a four-column rental list: [rent-list columns='4'] Show rentals from selected category IDs: [rent-list category='2,3'] Show the booking form for one rental item: [rent-add-to-cart id='1'] Support Need help or want to suggest an improvement? Use the support form. Theme compatibility The plugin is designed to work with standards-compliant WordPress themes. Other plugins Booking and Rental Manager for WooCommerce Addon: Seasonal Pricing Bus Booking Manager Bus Ticket Booking with Seat Reservation WooCommerce Events Manager Privacy Policy Booking and Rental Manager for WooCommerce uses the Appsero SDK to collect basic telemetry data only after the user gives permission through the admin notice. This helps with troubleshooting and product improvements. Appsero does not collect data by default. Data collection starts only after user consent. Learn more about how Appsero collects and uses data.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C