CVE-2025-58991: WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Req

WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Request Forgery (CSRF) Vulnerability

Status

Published

2025-09-09

Updated

2026-04-28

Assigning organization

Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking Bundle Hours: from n/a through 0.7.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cristiano Zanca WooCommerce Booking Bundle Hours

Default version status: unaffected

n/a to ≤ 0.7.4affected

References

https://patchstack.com/database/wordpress/plugin/woo-booking-bundle-hours/vulnerability/wordpress-woocommerce-booking-bundle-hours-plugin-0-7-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve ↗