CVE-2025-10124

MediumCVSS 4.5/10Last modified Oct 8, 2026

Description

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-101256.4The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versionCVE-2025-101266.4The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versionsCVE-2025-101279.8Daikin Europe N.V Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow aCVE-2025-101286.4The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all verCVE-2025-101296.4The WordPress Live Webcam Widget & Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shoCVE-2025-10136.5A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential prCVE-2025-101306.4The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and CVE-2025-101316.4The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versioCVE-2025-101326.4The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up tCVE-2025-101336.4The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in aCVE-2025-101349.1The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valiCVE-2025-101356.4The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to,
CVE-2025-10124: Medium severity, CVSS 4.5 | Vulnix