WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment

Create rental and booking products with WooCommerce for cars, bikes, equipment, dresses, resorts, appointments, and more.

18Reported vulnerabilities
8.8Highest CVSS score
2.7.5Latest version
1,000+Active installs

What to do now

Update Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment to 2.7.7 or later. 18 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 11, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2025-27011 High 8.8 0.6% 2.2.8 and earlier 2.2.9 April 11, 2025
CVE-2025-26921 High 8.8 0.5% 2.2.6 and earlier 2.2.7 February 23, 2025
CVE-2026-78257 High 7.5 0.5% 2.7.5 and earlier 2.7.6 August 25, 2026
CVE-2025-69328 High 7.5 0.3% 2.5.9 and earlier 2.6.0 February 9, 2026
CVE-2025-64266 High 7.5 0.4% 2.5.4 and earlier 2.5.5 September 20, 2025
CVE-2025-49904 High 7.2 0.2% 2.5.3 and earlier 2.5.4 November 1, 2025
CVE-2024-12412 Medium 6.1 0.4% 0 to 2.2.1 (inclusive) 2.2.2 January 11, 2025
CVE-2026-78258 Medium 5.3 0.2% 2.7.5 and earlier 2.7.6 August 24, 2026
CVE-2026-59532 Medium 5.3 0.3% 2.7.2 and earlier 2.7.3 July 23, 2026
CVE-2026-57404 Medium 5.3 0.3% 2.6.9 and earlier 2.7.0 July 8, 2026
CVE-2026-57660 Medium 5.3 0.3% 2.7.1 and earlier 2.7.2 June 26, 2026
CVE-2025-47585 Medium 5.3 0.3% 2.3.8 and earlier 2.3.9 May 22, 2025
CVE-2025-39390 Medium 5.3 0.3% 2.3.6 and earlier 2.3.7 April 18, 2025
CVE-2025-39457 Medium 5.3 0.3% 2.2.8 and earlier 2.2.9 April 17, 2025
CVE-2025-22720 Medium 5.3 0.3% 2.2.1 and earlier 2.2.2 January 15, 2025
CVE-2023-35048 Medium 4.4 0.4% 1.2.1 and earlier 1.2.2 June 13, 2023
CVE-2026-81762 Medium 4.3 0.3% 2.7.6 and earlier 2.7.7 August 28, 2026
CVE-2026-23972 Medium 4.3 0.3% 2.6.0 and earlier 2.6.1 March 23, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.