CVE-2026-14854

HighCVSS 7.5/10Last modified Oct 13, 2026

Description

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-148556.4The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and CVE-2026-148566.3A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by in CVE-2026-148574.3The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified CVE-2026-148584.3The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated CVE-2026-148594.3The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any CVE-2026-14868.8A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Pro CVE-2026-148605.3The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input,CVE-2026-148617.5The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is author CVE-2026-148623.7The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauth CVE-2026-148638.8FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve r CVE-2026-148645.4The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing CVE-2026-148655.3In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD