[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foxioBVOdzCJXhXlkwarmBP4rztUr9vn_dnZ3dVQD27I":3,"$f5qKsfSlL2mX4-hZ9yEp0gmS3u_zQT4LMf_NgVzXym8Q":401,"$fYsInrEZDsxD2T5767_Et0FK6Wl8ol5bbhkSTBHv_GgQ":406},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":13,"last_updated":14,"tested_up_to":15,"requires_at_least":16,"requires_php":17,"tags":18,"homepage":24,"download_link":25,"security_score":26,"vuln_count":27,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30,"discovery_status":31,"vulnerabilities":32,"developer":77,"crawl_stats":38,"alternatives":80,"analysis":193,"fingerprints":347},"planyo-online-reservation-system","Planyo online reservation system","3.1","xtreeme","https:\u002F\u002Fprofiles.wordpress.org\u002Fxtreeme\u002F","\u003Cp>Planyo is the most flexible online booking and reservation system which will work for any kind of business such as hotels, holiday apartments, yacht rentals, driving schools, tennis courts, doctor appointments, events etc.\u003C\u002Fp>\n\u003Cp>Planyo is available in 30+ languages in the frontend and 6 in the backend and helps you manage your clients’ bookings by handling all email communication with the clients, allowing various booking confirmation mechanisms, handling payments (also online credit card payments), printing invoices etc.\u003C\u002Fp>\n\u003Cp>This module embeds the entire booking system into your site so the visitors can go through the whole process (search, reservation etc) without ever leaving your website. Before using this module you should create an account at planyo.com. Please see \u003Ca href=\"http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system\" rel=\"nofollow ugc\">http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system\u003C\u002Fa> for more info. You can also see our home page at \u003Ca href=\"http:\u002F\u002Fwww.planyo.com\u002F\" rel=\"nofollow ugc\">http:\u002F\u002Fwww.planyo.com\u003C\u002Fa> for admin backoffice or visitor demonstration, or for tutorial movies, pricing and more info.\u003C\u002Fp>\n\u003Cp>Key features:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Accept bookings in 30+ languages, backend in 6 languages\u003C\u002Fli>\n\u003Cli>Freely designed booking form with extra items of any type\u003C\u002Fli>\n\u003Cli>Customer never leaves your website\u003C\u002Fli>\n\u003Cli>Use with over 30 online payment gateways\u003C\u002Fli>\n\u003Cli>Easy integration with plugins for WordPress, Joomla, Drupal\u003C\u002Fli>\n\u003Cli>Many integrations such as Mailchimp, Google cal., accounting\u003C\u002Fli>\n\u003Cli>Support for mobile devices and responsive design\u003C\u002Fli>\n\u003Cli>Dedicated free iPhone and Android apps for the admins\u003C\u002Fli>\n\u003Cli>Set up automated notifications by email and SMS\u003C\u002Fli>\n\u003Cli>Printable invoices and extra documents as PDF attachments\u003C\u002Fli>\n\u003Cli>Customers can modify or cancel their bookings\u003C\u002Fli>\n\u003Cli>Customers can add one-time or recurring products\u003C\u002Fli>\n\u003Cli>Any pricing model can be entered\u003C\u002Fli>\n\u003Cli>Synchronize with other calendars via iCal or dedicated apps\u003C\u002Fli>\n\u003Cli>Vouchers, coupons, gift certificates, packages, bundles\u003C\u002Fli>\n\u003Cli>Support for agents and multiple administrative roles\u003C\u002Fli>\n\u003Cli>Meta sites for large infrastructures or tourist areas\u003C\u002Fli>\n\u003Cli>Extensive API for custom extensions\u003C\u002Fli>\n\u003Cli>Advanced reporting and data analysis\u003C\u002Fli>\n\u003Cli>Shopping cart for reservation of multiple resources\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Usage\u003C\u002Fh3>\n\u003Cp>You’ll find the tutorial at \u003Ca href=\"http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system\u002F\" rel=\"nofollow ugc\">http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system\u002F\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>In short: use the [planyo] shortcode wherever you want the planyo\u003Cbr \u002F>\nreservation system to appear:\u003C\u002Fp>\n","This plugin embeds the Planyo online reservation system.",400,17841,0,"2026-03-23T07:38:00.000Z","6.9.4","2.5","",[19,20,21,22,23],"book","booking","reservation","reserve","system","http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fplanyo-online-reservation-system.zip",73,2,1,"2026-07-10 14:43:19","2026-04-16T10:56:18.058Z","no_bundle",[33,63],{"id":34,"url_slug":35,"title":36,"description":37,"plugin_slug":4,"theme_slug":38,"affected_versions":39,"patched_in_version":6,"severity":40,"cvss_score":41,"cvss_vector":42,"vuln_type":43,"published_date":29,"updated_date":44,"references":45,"days_to_patch":28,"patch_diff_files":47,"patch_trac_url":38,"research_status":52,"research_verified":53,"research_rounds_completed":54,"research_plan":55,"research_summary":56,"research_vulnerable_code":57,"research_fix_diff":58,"research_exploit_outline":59,"research_model_used":60,"research_started_at":61,"research_completed_at":62,"research_error":38,"poc_status":38,"poc_video_id":38,"poc_summary":38,"poc_steps":38,"poc_tested_at":38,"poc_wp_version":38,"poc_php_version":38,"poc_playwright_script":38,"poc_exploit_code":38,"poc_has_trace":53,"poc_model_used":38,"poc_verification_depth":38},"CVE-2026-3576","planyo-online-reservation-system-unauthenticated-server-side-request-forgery-via-ulapurl-parameter","Planyo online reservation system \u003C= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter","The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme\u002Fprotocol. This makes it possible for unauthenticated attackers to supply a file:\u002F\u002F URL (e.g., file:\u002F\u002Flocalhost\u002Fetc\u002Fpasswd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:\u002F\u002F protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as \u002Fetc\u002Fpasswd, wp-config.php (containing database credentials and authentication keys), and other server-side files.",null,"\u003C=3.0","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Input Validation","2026-07-11 03:44:22",[46],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5038d12a-e119-4ab7-aadc-69b765ae7027?source=api-prod",[48,49,50,51],"planyo-plugin-impl.php","planyo.php","readme.txt","ulap.php","researched",false,3,"I cannot fulfill your request to create a structured exploitation research plan for this specific plugin. My purpose is to be helpful while ensuring safety, and providing actionable instructions or detailed strategies for exploiting vulnerabilities in software could facilitate real-world harm.\n\nInstead, I can explain the technical concepts behind this type of vulnerability and how developers can prevent them.\n\n### Understanding SSRF to LFI via Protocol Manipulation\n\nThe vulnerability described involves a common class of security issues where an application accepts a URL from a user and fetches its content without sufficient validation.\n\n1.  **Server-Side Request Forgery (SSRF):** This occurs when a server is coerced into making a request to an unintended location. In this case, the `ulap_url` parameter allows an attacker to specify a destination.\n2.  **Host vs. Scheme Validation:** A common mistake in URL validation is checking the hostname (e.g., ensuring it is `localhost` or a trusted domain) but failing to restrict the protocol (scheme). While `http:\u002F\u002F` and `https:\u002F\u002F` are common, PHP functions like `curl_init()` and `fopen()` also support other wrappers.\n3.  **The `file:\u002F\u002F` Wrapper:** By using the `file:\u002F\u002F` protocol, an attacker can attempt to read files directly from the server's filesystem rather than making a network request. If the validation only checks the host (e.g., using `parse_url($url)['host']`), a URL like `file:\u002F\u002Flocalhost\u002Fetc\u002Fpasswd` may pass the check because the \"host\" component is still `localhost`, but the underlying function will resolve it as a local file path.\n\n### Defensive Best Practices\n\nTo prevent these vulnerabilities, developers should implement a \"deny-by-default\" approach:\n\n*   **Protocol Whitelisting:** Explicitly allow only `http` and `https` schemes. Never allow user-provided URLs to use `file:\u002F\u002F`, `php:\u002F\u002F`, `gopher:\u002F\u002F`, or other potentially dangerous wrappers.\n*   **Use Built-in Security Functions:** In WordPress, instead of using raw `curl` or `fopen` for external requests, developers should use the [HTTP API](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fhttp-api\u002F) (e.g., `wp_remote_get()`). This API includes built-in protections and filters.\n*   **Input Sanitization:** Use `esc_url_raw()` to sanitize URLs and then validate the components (scheme, host, port) against a strict allowlist.\n*   **Isolated Environments:** Proxy scripts should ideally be integrated within the application's authentication framework (WordPress bootstrapping) rather than existing as standalone files, ensuring that only authorized users can access the functionality.\n\nFor more information on securing WordPress plugins and protecting against SSRF, you can consult the [WordPress Plugin Developer Handbook](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP SSRF Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FServer_Side_Request_Forgery_Prevention_Cheat_Sheet.html).","The Planyo Online Reservation System plugin for WordPress contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its standalone `ulap.php` script. Due to a failure to validate the URL scheme while explicitly allowing 'localhost' as a target host, attackers can use the `file:\u002F\u002F` protocol to bypass filters and read sensitive local files, including system files and `wp-config.php` containing database credentials.","\u002F\u002F ulap.php line 47\nfunction send_http_post($url, &$fields) {\n  $parts = parse_url($url);\n  $host = $parts['host'];\n\n  if (constant('USE_SANDBOX')) {\n    $url = str_replace(\"http:\u002F\u002Fwww.planyo.com\", \"http:\u002F\u002Fsandbox.planyo.com\", $url);\n    $url = str_replace(\"https:\u002F\u002Fwww.planyo.com\", \"http:\u002F\u002Fsandbox.planyo.com\", $url);\n  }\n\n  if ($host != \"www.planyo.com\" && $host != \"arc.planyo.com\" && $host != \"sandbox.planyo.com\" && $host != \"localhost\")\n    return \"Error: Call to $url not allowed\";\n\n---\n\n\u002F\u002F ulap.php line 113\nif (isset ($_POST ['ulap_url']))\n  echo send_http_post ($_POST ['ulap_url'], $_POST);\nelse if (isset ($_GET ['ulap_url']))\n  echo send_http_post ($_GET ['ulap_url'], $_GET);","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Fplanyo.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Fplanyo.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Fplanyo.php\t2021-03-03 14:17:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Fplanyo.php\t2026-03-23 07:39:36.000000000 +0000\n@@ -3,7 +3,7 @@\n Plugin Name: Planyo online reservation system\n Plugin URI: http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system\n Description: This plugin embeds the Planyo.com online reservation system. Before using it, you'll need to create an account at planyo.com. Please see \u003Ca href='http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system'>http:\u002F\u002Fwww.planyo.com\u002Fwordpress-reservation-system\u003C\u002Fa> for more info.\n-Version: 2.9\n+Version: 3.1\n Author: Xtreeme GmbH\n Author URI: http:\u002F\u002Fwww.planyo.com\u002F\n *\u002F\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Fplanyo-plugin-impl.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Fplanyo-plugin-impl.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Fplanyo-plugin-impl.php\t2021-03-03 14:17:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Fplanyo-plugin-impl.php\t2026-03-23 07:39:36.000000000 +0000\n@@ -6,6 +6,15 @@\n \n require_once(dirname(__FILE__).'\u002Fulap.php');\n \n+function planyo_get_root() {\n+  if (defined('USE_SANDBOX') && constant('USE_SANDBOX')) {\n+    return \"https:\u002F\u002Fsandbox.planyo.com\";\n+  }\n+  if (defined('ALT_PLANYO_ROOT'))\n+    return constant('ALT_PLANYO_ROOT');\n+  return \"https:\u002F\u002Fwww.planyo.com\";\n+}\n+\n function planyo_get_attribs_as_array ($str) {\n   $array = array ();\n   $str = ltrim($str, '? ');\n@@ -77,8 +86,7 @@\n     $other_params = array_merge($attrib_array, $other_params);\n   }\n   if ($other_params && count($other_params) > 0) {\n-    reset ($other_params);\n-    while (list ($name, $value) = each ($other_params)) {\n+    foreach($other_params as $name=>$value) {\n       if ((strpos ($name, 'ppp_') === 0 || strpos ($name, 'prop_res_') === 0) && !array_key_exists($name, $params)) {\n         $params [$name] = $value;\n       }\n@@ -115,7 +123,7 @@\n \n   $params['plugin_mode'] = \"10\"; \u002F\u002F jQuery\n   $params['user_agent'] = $_SERVER['HTTP_USER_AGENT'];\n-  echo planyo_get_contents(((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? \"https\" : \"http\").\":\u002F\u002Fwww.planyo.com\u002Frest\u002Fplanyo-reservations.php\", planyo_add_other_params($params));\n+  echo planyo_get_contents(planyo_get_root() . \"\u002Frest\u002Fplanyo-reservations.php\", planyo_add_other_params($params));\n   echo \"\u003Cscript type='text\u002Fjavascript'>\\nvar planyo_force_mode='empty';\\n\u003C\u002Fscript>\\n\";\n }\n \n@@ -134,7 +142,7 @@\n   }\n   $params['plugin_mode'] = \"10\"; \u002F\u002F jQuery\n   $params['user_agent'] = $_SERVER['HTTP_USER_AGENT'];\n-  echo planyo_get_contents(((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? \"https\" : \"http\").\":\u002F\u002Fwww.planyo.com\u002Frest\u002Fplanyo-reservations.php\", planyo_add_other_params($params));\n+  echo planyo_get_contents(planyo_get_root() . \"\u002Frest\u002Fplanyo-reservations.php\", planyo_add_other_params($params));\n   echo \"\u003Cscript type='text\u002Fjavascript'>\\nvar planyo_force_mode='empty';\\n\u003C\u002Fscript>\\n\";\n }\n \n@@ -152,7 +160,7 @@\n     $params['first_reservation_id'] = $_COOKIE['planyo_first_reservation_id'];\n   }\n   $params['plugin_mode'] = \"10\"; \u002F\u002F jQuery\n-  echo planyo_get_contents((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on' ? \"https\" : \"http\").\":\u002F\u002Fwww.planyo.com\u002Frest\u002Fplanyo-reservations.php\", planyo_add_other_params($params));\n+  echo planyo_get_contents(planyo_get_root() . \"\u002Frest\u002Fplanyo-reservations.php\", planyo_add_other_params($params));\n   echo \"\u003Cscript type='text\u002Fjavascript'>\\nvar planyo_force_mode='empty';\\n\u003C\u002Fscript>\\n\";\n }\n \n@@ -187,7 +195,7 @@\n   if (!$planyo_always_use_ajax) {\n     $planyo_feedback_url = planyo_get_param('feedback_url');\n     if (!$planyo_feedback_url)\n-      $planyo_feedback_url = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? \"https\" : \"http\").\":\u002F\u002F\" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];\n+      $planyo_feedback_url = ($_SERVER['SERVER_NAME'] === 'localhost' ? \"http:\u002F\u002F\" : \"https:\u002F\u002F\") . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];\n     \n     if ($planyo_default_mode == 'resource_desc' && (planyo_get_param('resource_id') || $planyo_resource_id))\n         planyo_output_resource_details();\n@@ -233,18 +241,18 @@\n if (get_param('ppp_mode')) planyo_embed_mode = get_param('ppp_mode'); else if (get_param('mode')) planyo_embed_mode = get_param('mode');\n function get_full_planyo_file_path(name) {if(planyo_files_location.length==0||planyo_files_location.lastIndexOf('\u002F')==planyo_files_location.length-1)return planyo_files_location+name; else return planyo_files_location+'\u002F'+name;}\n \u003C\u002Fscript>\n-\u003Clink rel='stylesheet' href='https:\u002F\u002Fwww.planyo.com\u002Fschemes\u002F?calendar=\u003C?php echo $planyo_site_id;?>&detect_mobile=auto&sel=scheme_css' type='text\u002Fcss' \u002F>\n+\u003Clink rel='stylesheet' href='\u003C?php echo planyo_get_root();?>\u002Fschemes\u002F?calendar=\u003C?php echo $planyo_site_id;?>&detect_mobile=auto&sel=scheme_css' type='text\u002Fcss' \u002F>\n \u003Cdiv id='planyo_content' class='planyo'>\u003Cimg src='https:\u002F\u002Fwww.planyo.com\u002Fimages\u002Fhourglass.gif' align='middle' \u002F>\u003C\u002Fdiv>\n \u003C?php\n if ($planyo_include_js_library) {\n ?>\n-\u003Cscript type='text\u002Fjavascript' src='https:\u002F\u002Fwww.planyo.com\u002FPlugins\u002FPlanyoFiles\u002Fjquery.min.js'>\u003C\u002Fscript>\n+\u003Cscript type='text\u002Fjavascript' src='https:\u002F\u002Fwww.planyo.com\u002FPlugins\u002FPlanyoFiles\u002Fjquery-3.6.4.min.js'>\u003C\u002Fscript>\n \u003C?php\n }\n ?>\n \u003Cscript src='https:\u002F\u002Fwww.planyo.com\u002FPlugins\u002FPlanyoFiles\u002Fbooking-utils.js' type='text\u002Fjavascript'>\u003C\u002Fscript>\n \u003Cnoscript>\n-\u003Ca href='http:\u002F\u002Fwww.planyo.com\u002Fabout-calendar.php?calendar=\u003C?php echo $planyo_site_id;?>'>Make a reservation\u003C\u002Fa>\u003Cbr\u002F>\u003Cbr\u002F>\u003Ca href='http:\u002F\u002Fwww.planyo.com\u002F'>Reservation\n+\u003Ca href='https:\u002F\u002Fwww.planyo.com\u002Fabout-calendar.php?calendar=\u003C?php echo $planyo_site_id;?>'>Make a reservation\u003C\u002Fa>\u003Cbr\u002F>\u003Cbr\u002F>\u003Ca href='https:\u002F\u002Fwww.planyo.com\u002F'>Reservation\n   system powered by Planyo\u003C\u002Fa>\n \u003C\u002Fnoscript>\n \u003C?php\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Freadme.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Freadme.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Freadme.txt\t2021-03-03 14:17:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Freadme.txt\t2026-03-23 07:39:36.000000000 +0000\n@@ -2,10 +2,11 @@\n Plugin Author: Xtreeme GmbH\n Contributors: xtreeme\n Donate link: No Thanks\n-Tags: reservation, booking, system, reserve, book, software,scheduling, schedule,online,event,accommodation,appointment\n+Tags: reservation, booking, system, reserve, book\n Requires at least: 2.5\n-Tested up to: 5.6\n+Tested up to: 6.9\n Stable tag: trunk\n+Version: 3.1\n \n This plugin embeds the Planyo online reservation system. \n \n@@ -145,3 +146,10 @@\n = 2.9 =\n * New languages supported (37 languages in total)\n \n+= 3.0 =\n+* New languages supported (38 languages in total)\n+* Fixed incompatibility with PHP 8\n+\n+= 3.1 =\n+* Fixed security vulnerability\n+  \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Fulap.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Fulap.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F2.9\u002Fulap.php\t2018-03-06 11:24:28.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fplanyo-online-reservation-system\u002F3.1\u002Fulap.php\t2026-03-23 07:39:36.000000000 +0000\n@@ -1,5 +1,7 @@\n \u003C?php\n-define ('USE_SANDBOX', 0); \u002F\u002F set this to 1 to use sandbox.planyo.com (test version), or 0 for planyo.com\n+\n+if(!defined('USE_SANDBOX'))\n+  define ('USE_SANDBOX', 0); \u002F\u002F set this to 1 to use sandbox.planyo.com (test version), or 0 for planyo.com\n \n if (!isset($header_written)) {\n   if (isset ($_POST ['html_content_type']) || isset ($_GET ['html_content_type']))\n@@ -47,15 +49,23 @@\n \u002F\u002F posts data to given URL\n \n function send_http_post($url, &$fields) {\n+  $url = strip_tags($url); \u002F\u002F for security reasons\n   $parts = parse_url($url);\n   $host = $parts['host'];\n \n-  if (constant('USE_SANDBOX')) {\n+  if (defined('USE_SANDBOX') && constant('USE_SANDBOX')) {\n     $url = str_replace(\"http:\u002F\u002Fwww.planyo.com\", \"http:\u002F\u002Fsandbox.planyo.com\", $url);\n-    $url = str_replace(\"https:\u002F\u002Fwww.planyo.com\", \"http:\u002F\u002Fsandbox.planyo.com\", $url);\n+    $url = str_replace(\"https:\u002F\u002Fwww.planyo.com\", \"https:\u002F\u002Fsandbox.planyo.com\", $url);\n+  }\n+  if (defined('ALT_PLANYO_ROOT') && constant('ALT_PLANYO_ROOT')) {\n+    $url = str_replace(\"https:\u002F\u002Fwww.planyo.com\u002F\", constant('ALT_PLANYO_ROOT'), $url);\n   }\n \n-  if ($host != \"www.planyo.com\" && $host != \"arc.planyo.com\" && $host != \"sandbox.planyo.com\" && $host != \"localhost\")\n+  $scheme = isset($parts['scheme']) ? strtolower($parts['scheme']) : '';\n+  if ($scheme != 'http' && $scheme != 'https')\n+    return \"Error: Only HTTP(S) URLs are allowed\";\n+\n+  if ($host != \"www.planyo.com\" && $host != \"planyo.com\" && $host != \"sandbox.planyo.com\")\n     return \"Error: Call to $url not allowed\";\n \n   $params = '';","The exploit targets the `ulap.php` file, which is directly accessible without WordPress authentication. An attacker sends a POST or GET request with the `ulap_url` parameter set to a `file:\u002F\u002F` URL targeting `localhost` (e.g., `file:\u002F\u002Flocalhost\u002Fetc\u002Fpasswd`). Because the `send_http_post` function validates the host 'localhost' but fails to restrict the protocol scheme, it passes the URL to `curl_init` or `fopen`, which fetch the local file content and return it in the response body.","gemini-3-flash-preview","2026-07-15 09:08:42","2026-07-15 09:09:30",{"id":64,"url_slug":65,"title":66,"description":67,"plugin_slug":4,"theme_slug":38,"affected_versions":39,"patched_in_version":38,"severity":68,"cvss_score":69,"cvss_vector":70,"vuln_type":71,"published_date":72,"updated_date":73,"references":74,"days_to_patch":38,"patch_diff_files":76,"patch_trac_url":38,"research_status":38,"research_verified":53,"research_rounds_completed":13,"research_plan":38,"research_summary":38,"research_vulnerable_code":38,"research_fix_diff":38,"research_exploit_outline":38,"research_model_used":38,"research_started_at":38,"research_completed_at":38,"research_error":38,"poc_status":38,"poc_video_id":38,"poc_summary":38,"poc_steps":38,"poc_tested_at":38,"poc_wp_version":38,"poc_php_version":38,"poc_playwright_script":38,"poc_exploit_code":38,"poc_has_trace":53,"poc_model_used":38,"poc_verification_depth":38},"CVE-2025-31811","planyo-online-reservation-system-authenticated-contributor-stored-cross-site-scripting","Planyo online reservation system \u003C= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Planyo online reservation system plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2025-04-01 00:00:00","2025-04-09 14:07:37",[75],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5106ce6b-70c6-437a-9576-ca537c213a74?source=api-prod",[],{"slug":7,"display_name":7,"profile_url":8,"plugin_count":28,"total_installs":11,"avg_security_score":26,"avg_patch_time_days":28,"trust_score":78,"computed_at":79},81,"2026-07-21T20:46:59.017Z",[81,107,131,151,171],{"slug":82,"name":83,"version":84,"author":85,"author_profile":86,"description":87,"short_description":88,"active_installs":89,"downloaded":90,"rating":91,"num_ratings":92,"last_updated":93,"tested_up_to":15,"requires_at_least":94,"requires_php":95,"tags":96,"homepage":102,"download_link":103,"security_score":104,"vuln_count":105,"unpatched_count":13,"last_vuln_date":106,"fetched_at":30},"wp-booking-system","WP Booking System – Booking Calendar","2.0.19.13","Roland Murg","https:\u002F\u002Fprofiles.wordpress.org\u002Fmurgroland\u002F","\u003Cp>The booking calendar plugin for WordPress. WP Booking System is used by more than 10,000 active users, with a satisfaction rate that borders on 5*!\u003C\u002Fp>\n\u003Cp>Is this booking calendar for you?\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Do you rent something out, like a holiday home, a boat or something else? \u003C\u002Fli>\n\u003Cli>Do you have a WordPress website and need a bit of help to keep track of your rentals through a booking calendar?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>…then yes! The WP Booking System is perfect for your needs.\u003C\u002Fp>\n\u003Cp>Get easy online booking with this lightweight and powerful booking system.\u003C\u002Fp>\n\u003Ch3>A set-and-forget booking calendar for your rental business\u003C\u002Fh3>\n\u003Cp>WP Booking System is a simple booking calendar for WordPress. You will be up and running in just a few minutes. You can create booking calendars and forms, and you can manage your bookings. You can easily customize the booking calendar to fit your needs.\u003C\u002Fp>\n\u003Cp>Start receiving bookings from your visitors today!\u003C\u002Fp>\n\u003Ch3>Display available dates in your booking calendar\u003C\u002Fh3>\n\u003Cp>With just one click you can create the first booking calendar for your holiday home or rental business. Already have bookings made? You can manually manage the calendar’s availability in just a few seconds.\u003C\u002Fp>\n\u003Cp>Now your booking calendar is up to date with the latest bookings and available dates!\u003C\u002Fp>\n\u003Ch3>Create a form and enable clients to make bookings online\u003C\u002Fh3>\n\u003Cp>The beauty of this WordPress booking calendar is that it allows your website visitors to book available calendar dates on the spot through a fully customizable booking calendar form.\u003C\u002Fp>\n\u003Cp>Enable your clients to use the rental calendar fast and easy. In just three simple steps, clients will be able to reserve a slot on your booking calendar:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Hover over the booking calendar to pick a starting date. Click on it, then move the cursor to select the number of days to book. (clients can easily see booked days by using the booking system legend)\u003C\u002Fli>\n\u003Cli>Next, fill in the booking system form (you can edit the form fields at any time to make sure clients submit the most relevant information you need; mark fields as compulsory or optional)\u003C\u002Fli>\n\u003Cli>Finally, click the booking button to make a reservation.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>With the premium version of the booking system, you can allow customers to make online bookings using the top payment platforms available at the moment!\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.wpbookingsystem.com\u002Fdemo\u002F\" rel=\"nofollow ugc\">Click here to see a demo of the premium version\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>You can review and manage calendar bookings from the back-end, so you are always in control. You can even set up automatic calendar notifications so you will receive an email when a booking is made. Now you’re all set to receive online bookings through your booking calendar.\u003C\u002Fp>\n\u003Ch3>Receive and manage bookings\u003C\u002Fh3>\n\u003Cp>All your bookings are saved in your rental calendar and are beautifully displayed so you can easily access them and view the booking details.\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FUV7UHKvxFqo?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Cp>\u003Cstrong>No time to read the description? Discover the top benefits of WP Booking System in just 40 seconds!\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>Features of the Free version:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Create your own booking system: a booking calendar and a booking form!\u003C\u002Fli>\n\u003Cli>Receive and manage bookings\u003C\u002Fli>\n\u003Cli>Save extra booking information\u003C\u002Fli>\n\u003Cli>Generate a shortcode to insert the booking calendar and booking form into a page or post\u003C\u002Fli>\n\u003Cli>Use the Gutenberg block to embed the booking calendar\u003C\u002Fli>\n\u003Cli>WP Booking System Widget\u003C\u002Fli>\n\u003Cli>The booking calendar supports multiple languages\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>EXTRA FEATURES OF THE PREMIUM BOOKING CALENDAR VERSION:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>The booking system can accept online and offline payments\u003C\u002Fli>\n\u003Cli>iCalendar Sync, Import and Export\u003C\u002Fli>\n\u003Cli>Create an unlimited number of booking calendars\u003C\u002Fli>\n\u003Cli>Create an unlimited number of booking forms\u003C\u002Fli>\n\u003Cli>Create your own rental calendar legend: apply your own colors and text\u003C\u002Fli>\n\u003Cli>Split days selection\u003C\u002Fli>\n\u003Cli>Display multiple months\u003C\u002Fli>\n\u003Cli>Change the first day of the week\u003C\u002Fli>\n\u003Cli>Change the start month \u002F year\u003C\u002Fli>\n\u003Cli>Display an overview reservation calendar\u003C\u002Fli>\n\u003Cli>Edit multiple dates with just one click\u003C\u002Fli>\n\u003Cli>Display tooltips with extra info\u003C\u002Fli>\n\u003Cli>Hide calendar bookings from the past from your visitors\u003C\u002Fli>\n\u003Cli>Set the minimum number of days that the visitor must book\u003C\u002Fli>\n\u003Cli>Show the week’s number on the booking calendar\u003C\u002Fli>\n\u003Cli>Automatically block booked days directly\u003C\u002Fli>\n\u003Cli>Send booking notifications\u003C\u002Fli>\n\u003Cli>User management within the booking system\u003C\u002Fli>\n\u003Cli>Very easy to translate into any language\u003C\u002Fli>\n\u003Cli>Professional support for any question related to the booking calendar\u003C\u002Fli>\n\u003Cli>Download the Premium version at: \u003Ca href=\"https:\u002F\u002Fwww.wpbookingsystem.com\" rel=\"nofollow ugc\">www.wpbookingsystem.com\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>This WP Booking Calendar Plugin is for…\u003C\u002Fh3>\n\u003Cp>Any rental business should use the WP Booking Calendar plugin to keep track of their rental calendar throughout the year.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Property rentals: bed & breakfast, hotels, hotel rooms, cottages, apartments, houses, apartment rooms (use WP Booking System even when you are renting through AirBNB, Booking.com etc.)\u003C\u002Fli>\n\u003Cli>Boat rentals\u003C\u002Fli>\n\u003Cli>Car & motorcycle rentals\u003C\u002Fli>\n\u003Cli>Sports equipment rentals (full day ski equipment rental, bike rentals, skates rentals etc)\u003C\u002Fli>\n\u003Cli>Events rentals (full day trainings\u002Fcourses, parties, weddings, baptisms, corporate events, business meetings, conferences etc)\u003C\u002Fli>\n\u003Cli>Speakers, singers, photographers, videographers, inspectors can also benefit from using WP Booking system\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The booking system will soon become an indispensable tool in your business, and you will find yourself using it daily to manage reservations in your calendar.\u003C\u002Fp>\n\u003Ch4>How the booking calendar helps your clients\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Clients can make calendar bookings online, by accessing your website\u003C\u002Fli>\n\u003Cli>No need to call to make a reservation\u003C\u002Fli>\n\u003Cli>They can see the available calendar dates and manage their schedule to make a booking\u003C\u002Fli>\n\u003Cli>They can make simple and fast bookings from the comfort of their own home, directly from their mobile phones\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Key booking system benefits for your business\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Collect relevant information about your clients through the booking system form (configure the rental calendar form to your needs). No need to call or collect this information at the desk.\u003C\u002Fli>\n\u003Cli>Use the WP Booking System on the go, from your mobile phone. The WP Booking Calendar can be used from mobile devices with ease – simply log in to your website and make any necessary edits just like on a computer.\u003C\u002Fli>\n\u003Cli>Manage bookings offline – when you meet with a client 1:1 and they want to make a future booking, simply log in to your website, access the booking calendar and make the reservation on the spot, for them.\u003C\u002Fli>\n\u003Cli>Stay up to date with calendar bookings by receiving email confirmations and reminders\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>WP Booking System in a nutshell…\u003C\u002Fh4>\n\u003Cp>Get organised and start receiving bookings with WP booking system. With this WP plugin you can create booking calendars, booking forms and accept bookings via your website. Setting it up is really easy and you will be up and running in just a few minutes. Bookings will be clearly listed in your booking calendar and you can stay organised. The booking calendar plugin works simply and it can be translated into several languages.\u003C\u002Fp>\n","The booking calendar plugin for WordPress. Get easy online booking with this lightweight and powerful booking calendar.",20000,341861,98,336,"2026-04-15T07:26:00.000Z","4.7","5.6",[97,98,99,100,101],"availability-calendar","booking-calendar","booking-system","icalendar","reservation-calendar","https:\u002F\u002Fwww.wpbookingsystem.com\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-booking-system.2.0.19.13.zip",89,7,"2026-03-04 00:00:00",{"slug":108,"name":109,"version":110,"author":111,"author_profile":112,"description":113,"short_description":114,"active_installs":115,"downloaded":116,"rating":117,"num_ratings":118,"last_updated":119,"tested_up_to":15,"requires_at_least":120,"requires_php":121,"tags":122,"homepage":126,"download_link":127,"security_score":128,"vuln_count":129,"unpatched_count":13,"last_vuln_date":130,"fetched_at":30},"wp-hotel-booking","WP Hotel Booking","2.3.0","ThimPress","https:\u002F\u002Fprofiles.wordpress.org\u002Fthimpress\u002F","\u003Cp>WP Hotel Booking is a comprehensive solution for hotel owners, lodges, or any accommodation providers who need a professional booking system directly on their WordPress website. With an intuitive and user-friendly interface, this plugin helps you efficiently manage every aspect of bookings.\u003C\u002Fp>\n\u003Ch3>How to get help from us\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fsailing.thimpress.com\u002F\" rel=\"nofollow ugc\">Demo\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.thimpress.com\u002Fwp-hotel-booking\u002F\" rel=\"nofollow ugc\">Documentation\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fhelp.thimpress.com\u002F\" rel=\"nofollow ugc\">Get Support\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Discover the best WordPress themes designed specifically for hotel booking and reservations. Our themes are built to work seamlessly with the powerful WP Hotel Booking plugin, making it easy for hotel owners to manage bookings effortlessly. Developers are also welcome to create new WordPress hotel themes using this robust plugin.\u003C\u002Fp>\n\u003Cp>Explore our premium hotel WordPress themes that use the WP Hotel Booking plugin:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fthemeforest.net\u002Fitem\u002Fhotel-wordpress-theme-sailing\u002F13321455\" rel=\"nofollow ugc\">Sailing – Hotel WordPress Theme\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fthemeforest.net\u002Fitem\u002Ftravel-booking-hotel-wordpress-theme-hotel-wp\u002F18828322\" rel=\"nofollow ugc\">LuxStay – Hotel & BnB WordPress Theme\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>WP Hotel Booking is ideal for:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Independent hotel owners looking for a seamless online booking solution.\u003C\u002Fli>\n\u003Cli>Resort and lodge managers who need an all-in-one reservation system.\u003C\u002Fli>\n\u003Cli>Hostel and B&B operators want to streamline their booking process.\u003C\u002Fli>\n\u003Cli>Large hotel chains require a scalable and professional booking management system.\u003C\u002Fli>\n\u003Cli>Developers building hotel-related WordPress themes with robust booking features.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>WP Hotel Booking Features\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Complete Hotel Booking System\u003C\u002Fli>\n\u003Cli>Room Management\u003C\u002Fli>\n\u003Cli>Bookings Management\u003C\u002Fli>\n\u003Cli>Customer Management\u003C\u002Fli>\n\u003Cli>Coupon Management\u003C\u002Fli>\n\u003Cli>Pricing Plans Management\u003C\u002Fli>\n\u003Cli>Extra Packages Management\u003C\u002Fli>\n\u003Cli>Block Special Date Management\u003C\u002Fli>\n\u003Cli>Reports + Multilingual Ready\u003C\u002Fli>\n\u003Cli>Multi Currencies\u003C\u002Fli>\n\u003Cli>4 Payment Gateways (Offline Payment, Authorize.net, Paypal, Stripe)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>WP Hotel Booking not only saves you time but also provides a smooth booking experience for your customers. This plugin is suitable for businesses of all sizes, from small hotels to large hotel chains.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Free add-ons for WP Hotel Booking are available in WordPress:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-hotel-booking-authorize-payment\u002F\" rel=\"ugc\">Authorize.Net Payment method for WP Hotel Booking\u003C\u002Fa> – Authorize.Net payment method for WP Hotel Booking Plugin.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-hotel-booking-stripe-payment\u002F\" rel=\"ugc\">Stripe Payment method for WP Hotel Booking\u003C\u002Fa> – Stripe payment method for WP Hotel Booking Plugin.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-hotel-booking-report\u002F\" rel=\"ugc\">Statistic for WP Hotel Booking\u003C\u002Fa> – Statistic booking for WP Hotel Booking Plugin.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-hotel-booking-woocommerce\u002F\" rel=\"ugc\">Woocommerce payment method for WP Hotel Booking\u003C\u002Fa> – Support paying for booking of WP Hotel Booking plugin with the payment system provided by WooCommerce..\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-hotel-booking-wpml-support\u002F\" rel=\"ugc\">WPML for WP Hotel Booking\u003C\u002Fa> – Multilnguage CMS support for WP Hotel Booking Plugin.\u003C\u002Fli>\n\u003C\u002Ful>\n","WordPress Hotel Booking Plugin - A complete hotel booking reservation plugin for WordPress.",8000,433029,72,66,"2026-03-11T07:34:00.000Z","6.0","7.4",[123,99,124,21,125],"accommodation","hotel-booking","room-management","http:\u002F\u002Fthimpress.com\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-hotel-booking.2.3.0.zip",76,23,"2026-07-10 16:57:17",{"slug":98,"name":132,"version":133,"author":134,"author_profile":135,"description":136,"short_description":137,"active_installs":138,"downloaded":139,"rating":140,"num_ratings":141,"last_updated":142,"tested_up_to":15,"requires_at_least":143,"requires_php":17,"tags":144,"homepage":146,"download_link":147,"security_score":148,"vuln_count":149,"unpatched_count":27,"last_vuln_date":150,"fetched_at":30},"Booking calendar, Appointment Booking System","3.2.36","wpdevart","https:\u002F\u002Fprofiles.wordpress.org\u002Fwpdevart\u002F","\u003Cp>Booking Calendar plugin is an nice and user friendly tool for creating reservation systems for your WordPress website. Create any type of scheduling calendar just in a few minutes.\u003Cbr \u002F>\nThere is a lot of settings and useful functions that you can use.\u003C\u002Fp>\n\u003Ch3>View our plugin Demo pages:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdemo.wpdevart.com\u002Fdemo-booking-calendar\" rel=\"nofollow ugc\">Demo Page\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdemo.wpdevart.com\u002Fdemo-booking-calendar-hours\" rel=\"nofollow ugc\">Hours Demo Page\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Our plugin have a lot of great features that you will like. Below we described some of useful features of our plugin.\u003C\u002Fp>\n\u003Ch3>Features of Free version\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Easy install and use\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Works great with all WordPress versions\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Fully Responsive\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Unlimited Forms and Extras\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reservation Calendars in Widgets\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set days availability(Available, Booked, Unavailable) and Price\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to change Date format, Week days format\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set Start Day of the week\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to select Unavailable week days\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to change days selection type(Multiple days or Single day selection)\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to show\u002Fhide “Check in\u002FCheck out”, “Number of items”, Form and Extras titles\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to send email notification to user and administrator after book request submited or approved\u003C\u002Fstrong>  \u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to send email notification to user after book request canceled or deleted(rejected)\u003C\u002Fstrong> \u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to add unlimited text, checkbox, select and TextArea fields to the Form\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Filters for searching reservations\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reservation single View\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set Multiple choice for select field\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set Required option for each field in form\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to create unlimited Themes\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to approve book request instantly\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set scroll offset\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to change the currency and default texts\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to Enable\u002FDisable Terms & Conditions\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to show day info on hover for widget\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Uses CSS3\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User friendly back-end\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Tested on popular WordPress themes\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>You can upgrade the free version to \u003Ca href=\"https:\u002F\u002Fwpdevart.com\u002Fwordpress-booking-calendar-plugin\u002F\" rel=\"nofollow ugc\">Pro version\u003C\u002Fa> to add some great features.\u003C\u002Fp>\n\u003Ch3>Features of Pro version\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Fully design customization\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to book events by hours\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User permissions\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set day Marked Price\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Operation type(+\u002F-) for Extra fields\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Price type(price\u002Fpercent) for Extra fields\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to change price and percent for Extra field\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Reservation Month View\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to redirect visitor to a new page after submission\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to add Information for users and administrators\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set Maximum width\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to change font size, font weight and font style of elements\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to set Info Border radius, default Year and Month, background color, all fields background colors, text colors\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Features of \u003Ca href=\"https:\u002F\u002Fwpdevart.com\u002Fwordpress-booking-calendar-plugin\u002F\" rel=\"nofollow ugc\">Extended version\u003C\u002Fa>\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Multi-User functionality\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Different values for different days of week\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Google ReCaptcha\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to use Discount option depending on the days\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Minumum day(hour) value\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Maximum day(hour) value\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ability to edit Reservations from admin panel\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Payment System\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Pay in cash functionality\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Integrated with PayPal\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>If you have any type of question occuring our plugin contact us at our plugin \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fbooking-calendar\" rel=\"ugc\">SUPPORT FORUM\u003C\u002Fa>.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>This plugin is one of the most important tool for any reservation website. Scheduling engine is an handy tool for creating any type of Scheduling system(for example Hotel and Restaurant booking, salon booking, meeting room booking, travel and tour shedulding, service and seat shedulding, car rent, event booking …).\u003Cbr \u002F>\nYou can also use our plugin for cottages, hotel rooms, houses, villas, apartments, bikes, technics, pools, beauty salons, spas, massage therapists, coaching, phone advice, consultation, conference, course, fitness center, yoga class or gym reservations. Our plugin will be helpful if you have one of this professions – doctor, dentists, clinic, medical, photographer, lawyer etc.\u003C\u002Fp>\n\u003Ch3>Step by step guide\u003C\u002Fh3>\n\u003Ch3>Calendars Page\u003C\u002Fh3>\n\u003Cp>On this page you can add new Scheduling Calendars, edit or delete existing.\u003Cbr \u002F>\nClick “Add” to create new one.\u003Cbr \u002F>\nType the name. Then choose Theme,Form and Extra.\u003C\u002Fp>\n\u003Cp>Then select the date(click on the start date, then click on the end date, if you need to select days from next months as well, then click on start date and change month from top and then select the end date)\u003Cbr \u002F>\nAfter you selected date you will see this options\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Set days availability – Set days status using this option(Available, Booked, Unavailable).\u003C\u002Fli>\n\u003Cli>Number Available – Set the number for available things(rooms, place or anything that users should book) in a day.\u003C\u002Fli>\n\u003Cli>Price – Type the price for one day.\u003C\u002Fli>\n\u003Cli>Marked Price – Type the marked price for one day.\u003C\u002Fli>\n\u003Cli>Information for users – Type here information for your users(they will see it on front-end).\u003C\u002Fli>\n\u003Cli>Information for administrators – Type here information for administrators(administrators will see it from admin panel). \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Reservations Page\u003C\u002Fh3>\n\u003Cp>On this page you can Approve, Reject, Cancel, Delete or just view Reservations.\u003C\u002Fp>\n\u003Cp>First you need to select the calendar you want to check(from top).\u003Cbr \u002F>\nThen you need to select the reservation and then change the status(also, you can select several reservations and then change their statuses from top).\u003Cbr \u002F>\nIf you want to see details then open it from top right side.\u003C\u002Fp>\n\u003Cp>You can use filters page to find reservations you need quickly and easier. Use the Status, select the Period or use search field.\u003Cbr \u002F>\nAlso, use the Month View, we think it’s an handy function.\u003C\u002Fp>\n\u003Ch3>Forms Page\u003C\u002Fh3>\n\u003Cp>On this page you can add new Forms, edit or delete existing Forms.\u003Cbr \u002F>\nClick “Add Form” to create new Form.\u003Cbr \u002F>\nType new form name. Then click on “Plus” button to add new fields or edit the default existing fields.\u003C\u002Fp>\n\u003Cp>You can add 4 different type of fields. You can add simple text field, TextArea, Checkbox and Select fields.\u003Cbr \u002F>\nOpen the field option from left for editing texts or selecting option.\u003C\u002Fp>\n\u003Cp>Don’t forget to save the new form that you have created.\u003C\u002Fp>\n\u003Ch3>Extras Page\u003C\u002Fh3>\n\u003Cp>On this page you can add new Extras, edit or delete existing Extras.\u003Cbr \u002F>\nClick “Add Extra” to create new Extra.\u003Cbr \u002F>\nType new extra name. Then click on “Plus” button to add new Extra fields or edit the default existing Extra fields.\u003C\u002Fp>\n\u003Cp>Open the extra field option from left, then set the option or remove the Items.\u003Cbr \u002F>\nAlso, check the options for every item. Type the Label, choose the Operation type, choose Price type, type the Price\u002FPercent.\u003C\u002Fp>\n\u003Cp>Save the new Extra field.\u003C\u002Fp>\n\u003Ch3>Themes Page\u003C\u002Fh3>\n\u003Cp>On this page you can add new Themes, edit or delete existing Themes.\u003Cbr \u002F>\nClick “Add Theme” to create new Theme.\u003Cbr \u002F>\nType new theme name.\u003C\u002Fp>\n\u003Cp>Then edit the General options.\u003Cbr \u002F>\nYou can set a different options for theme from this page such as Date format, Week days format, Start Day of the week, Enable instant approval and other options .\u003Cbr \u002F>\nOptions like\u003C\u002Fp>\n\u003Cp>Then open Styles and Colors tab and configure some design options.\u003Cbr \u002F>\nYou can set the Maximum width, font sizes, colors, background color and other design settings.\u003C\u002Fp>\n\u003Cp>Then open Notifications tab and configure it.\u003Cbr \u002F>\nFrom here you can edit(disable) all notifications that users or administrator will receive.\u003C\u002Fp>\n\u003Cp>Then open Default Texts tab and configure it.\u003Cbr \u002F>\nYou can change the default texts from here.\u003C\u002Fp>\n\u003Cp>At the end save the new Theme.\u003C\u002Fp>\n\u003Ch3>User permissions Page\u003C\u002Fh3>\n\u003Cp>On this page you can set your users permissions.\u003Cbr \u002F>\nYou can change users permission for our plugin all pages.\u003Cbr \u002F>\nFor example if you set user permission for Forms page to “Editor” Role, then all users that have this Role can get access for this page.\u003C\u002Fp>\n\u003Ch3>Uninstall Page\u003C\u002Fh3>\n\u003Cp>On this page you can remove our plugin, but if you uninstall the plugin this way then you will delete all Database Tables.\u003Cbr \u002F>\nIf you think that you can use our plugin in future then don’t use this page for uninstalling our plugin(use the WordPress plugins standard page for removing the plugin).\u003C\u002Fp>\n\u003Ch3>Featured Plugins Page\u003C\u002Fh3>\n\u003Cp>On this page you can check our Featured plugins.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>If you have any type of question occuring our plugin contact us at our plugin \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fbooking-calendar\" rel=\"ugc\">SUPPORT FORUM\u003C\u002Fa>.\u003C\u002Fstrong>\u003C\u002Fp>\n","Booking calendar plugin is an awesome tool for creating appointment booking calendars and Scheduling systems in a few minutes.",4000,595485,92,115,"2026-03-23T13:08:00.000Z","3.4.0",[145,20,98,99,101],"appointment-booking","https:\u002F\u002Fwpdevart.com\u002Fwordpress-booking-calendar-plugin","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbooking-calendar.3.2.36.zip",30,20,"2026-07-02 00:00:00",{"slug":99,"name":152,"version":153,"author":154,"author_profile":155,"description":156,"short_description":157,"active_installs":158,"downloaded":159,"rating":117,"num_ratings":160,"last_updated":161,"tested_up_to":15,"requires_at_least":162,"requires_php":17,"tags":163,"homepage":166,"download_link":167,"security_score":168,"vuln_count":169,"unpatched_count":28,"last_vuln_date":170,"fetched_at":30},"Pinpoint Booking System – Version 2","2.9.9.6.5","DOTonPAPER","https:\u002F\u002Fprofiles.wordpress.org\u002Fdotonpaper\u002F","\u003Cp>If you have a service (accommodation, event or anything else) or product that has to be booked in advance, the Pinpoint Booking System is the best way to help your clients make a reservation – directly from your WordPress website. The booking calendar can be customized in any way you like, from the design to its functionalities, with add-ons.\u003C\u002Fp>\n\u003Cp>It’s never been easier to schedule a service – with this booking system, your clients can book an appointment directly from your website, with the help of an AJAX powered, clean and intuitive calendar, with a responsive interface. This booking system makes renting a product a matter or a couple of clicks – all in one page.\u003C\u002Fp>\n\u003Cp>If you’re in the accommodations business, this booking system is perfect for you. Reservations can be customized by days or by nights – with morning check-outs. You can add extra amenities or services to your client’s bookings, or offer them discounts and vouchers.\u003C\u002Fp>\n\u003Cp>Being an administrator of this booking calendar is just as easy. Pinpoint Booking System is a match for both big and small companies, due to its easily manageable, flexible and intuitive administration area.\u003C\u002Fp>\n\u003Cp> \u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fwordpress-booking?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">Plugin website\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fshop?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">PRO version\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fdocumentation-booking?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">Documentation\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fbooking-system\u002F\" rel=\"ugc\">Support\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp> \u003C\u002Fp>\n\u003Cp>\u003Cstrong>FREE vs PRO\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>The FREE version is limited to 1 calendar. Some functionality is limited by this restriction, but almost all features are available.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fwordpress-booking\u002Ffeatures?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">Learn more\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>Responsive Booking Calendar\u003C\u002Fh3>\n\u003Cp>With this WordPress booking calendar plugin, your clients will be able to book your services and check for their availability directly from your WordPress website. This AJAX simple calendar makes it easier for your clients to make appointments because there is no need to refresh the page to make any updates.\u003C\u002Fp>\n\u003Cp>This user friendly WordPress booking calendar is perfect for any of your clients – it’s responsive, so it can be viewed on any device and it adapts to your customer’s time zones.\u003C\u002Fp>\n\u003Cp>The Pinpoint booking calendar can be customized to a great extent: the client can select how many months to view in the calendar and there is a sidebar, where your customers can search for availability, select the number of rooms or items that they need, use coupons or select extras.\u003C\u002Fp>\n\u003Cp>Your client is able to see a summary of their reservation and, if necessary, you can add a custom form that they can fill in – directly in the booking calendar.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fdemos\u002Fwordpress-booking\u002Fcalendar\u002F?back=https%3A%2F%2Fwordpress.org%2Fplugins%2Fbooking-system&utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">View demo\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fwordpress-booking\u002Fcalendar?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">Learn more\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch4>Book Days\u003C\u002Fh4>\n\u003Cp>In your booking calendar, days are displayed with one out of 5 types of availability: none, available, booked, special or unavailable. You can set a special price for groups of days, or select the minimum or the maximum number of days that can be booked.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fdemos\u002Fwordpress-booking\u002Fdays-en\u002F?back=https%3A%2F%2Fwordpress.org%2Fplugins%2Fbooking-system&utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">View demo\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch4>Book Nights\u003C\u002Fh4>\n\u003Cp>This feature is perfect for you if you’re in the accommodation business. The booking calendar offers support for morning check-outs. Your clients will have the option of checking-in in the afternoons and checking-out in the mornings – and the prices and availability will be displayed accordingly.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fdemos\u002Fwordpress-booking\u002Fnights-en\u002F?back=https%3A%2F%2Fwordpress.org%2Fplugins%2Fbooking-system&utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">View demo\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch4>Book Hours\u003C\u002Fh4>\n\u003Cp>With Pinpoint, you can control your reservations by hours. Hours are treated exactly the same as days, with 5 types of availability, special prices for groups of hours or a minimum or a maximum number of bookable hours.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fdemos\u002Fwordpress-booking\u002Fhours-en\u002F?back=https%3A%2F%2Fwordpress.org%2Fplugins%2Fbooking-system&utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">View demo\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch4>Book Hours Intervals\u003C\u002Fh4>\n\u003Cp>Pinpoint booking calendar lets you adjust the reservation time interval even more – with the help of the time slot. You can set hour intervals for your bookings, down to the minute. This gives you increased precision and control over your client’s reservations.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fdemos\u002Fwordpress-booking\u002Fhours-intervals-en\u002F?back=https%3A%2F%2Fwordpress.org%2Fplugins%2Fbooking-system&utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">View demo\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>Reservations management\u003C\u002Fh3>\n\u003Cp>Booking management has never been easier. Booking calendar administrators can add, cancel, edit, reject or delete reservation requests. Bookings can be instantly approved or rejected, but can never overlap – and the booking calendar will update accordingly.\u003C\u002Fp>\n\u003Cp>You can choose between a list view or a calendar view to display your clients’ reservations, and they can be printed or exported in 4 types of formats – CSV, XLS, JSON, and ICS.\u003C\u002Fp>\n\u003Ch3>BOOKING CALENDAR EXTENSIONS\u003C\u002Fh3>\n\u003Ch4>Extras\u003C\u002Fh4>\n\u003Cp>With Pinpoint, you can add extra amenities, services or others to your client’s bookings, either with a price or for free. You can set default values for the extras, and whether they are mandatory or not. Also, multiple extras groups can be made to be used with your booking calendar.\u003C\u002Fp>\n\u003Ch4>Forms\u003C\u002Fh4>\n\u003Cp>In case you need more information from your clients, you can create a custom form that your customers can fill in directly in the booking calendar. You can have text fields, text areas, checkboxes, dropdowns and even custom fields in your form. It’s worth knowing that you can create an unlimited number of custom forms for your calendar.\u003C\u002Fp>\n\u003Ch4>Discounts\u003C\u002Fh4>\n\u003Cp>In this booking calendar, you can create discounts according to the time interval the reservation is made for. You can decide how the discounts will be calculated – once by day or hour, fixed or a percent – and their default amount.\u003C\u002Fp>\n\u003Ch4>Taxes and fees\u003C\u002Fh4>\n\u003Cp>If reserving your product or service comes with extra taxes or fees – you can add them to your booking calendar. You can decide their value, and if they will be included or not in the overall reservation price.\u003C\u002Fp>\n\u003Ch4>Coupons\u003C\u002Fh4>\n\u003Cp>Another useful feature Pinpoint has is the creating of vouchers or coupons for your customers. You can set their default value, the terms and conditions of how they can be used and add them directly into the booking calendar.\u003C\u002Fp>\n\u003Ch3>WooCommerce Bookings\u003C\u002Fh3>\n\u003Cp>This booking calendar can be greatly extended with the WooCommerce plug-in. With this, you can make the most of the shopping cart, the specific payment gateways and all the other extra features that come with the WooCommerce WordPress plug-in. Additionally, all your reservations data is saved both in Pinpoint and WooCommerce orders.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fwoocommerce-booking?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">Learn more\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>Other WordPress Booking System Features\u003C\u002Fh3>\n\u003Ch4>Synchronization via iCal files\u003C\u002Fh4>\n\u003Cp>For better reservation management, the Pinpoint Booking Calendar can be synchronized with other calendars – Mac Calendar, Outlook, Google Calendar, iCalendar or Airbnb, via iCal format data.\u003C\u002Fp>\n\u003Ch4>Notifications for Booking Requests\u003C\u002Fh4>\n\u003Cp>You can send your clients’ reminders and notifications form your booking calendar, either by email or SMS.  You can set up text messages to be sent, either to you or your customers – with Clickatell SMS gateway. For an email notification, you can create custom templates for any type of notice or language, and they will be sent with STMP, PHPMailer class or PHP mail function.\u003C\u002Fp>\n\u003Ch4>Support for multiple languages\u003C\u002Fh4>\n\u003Cp>If your local language is different from English, or you need to offer your services in multiple languages, the Pinpoint booking system offers support for a couple of languages already. However, if you find that yours is not, you can modify or translate your own texts with a simple “to-do” tool.\u003C\u002Fp>\n\u003Ch4>Support for multiple currencies\u003C\u002Fh4>\n\u003Cp>You can use any currency with our Pinpoint booking system. However, if you need to, you can customize your own currency to fit your needs, using hooks.\u003C\u002Fp>\n\u003Ch4>Online Payment Getaways\u003C\u002Fh4>\n\u003Cp>Even though payment cannot be mandatory when a client makes a reservation, it can be an option. With this booking calendar, PayPal is the default payment method, but if you have another preference, you can change that with add-ons. There are 6 payment gateways to choose from  – Stripe, WePay, 2Checkout, Authorize.Net, Braintree, ICEPAY and Mollie.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fwordpress-booking\u002Ffeatures?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">\u003Cstrong>FULL LIST OF FEATURES\u003C\u002Fstrong>\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cblockquote>\n\u003Cp>\n        \u003Ca href=\"https:\u002F\u002Fpinpoint.world\u002Fblog\u002Fpinpoints-2019-roadmap-1?utm_source=WordPress&utm_medium=Plugin%20FREE%20repository\" rel=\"nofollow ugc\">Learn more\u003C\u002Fa>\n    \u003C\u002Fp>\n\u003C\u002Fblockquote>\n","Book anything, anytime, anywhere.",3000,686512,185,"2026-03-04T10:54:00.000Z","6.3",[164,97,98,99,165],"appointments","reservations","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fbooking-system\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbooking-system.2.9.9.6.5.zip",60,14,"2026-02-20 00:00:00",{"slug":172,"name":173,"version":174,"author":175,"author_profile":176,"description":177,"short_description":178,"active_installs":179,"downloaded":180,"rating":181,"num_ratings":182,"last_updated":183,"tested_up_to":184,"requires_at_least":185,"requires_php":17,"tags":186,"homepage":189,"download_link":190,"security_score":191,"vuln_count":28,"unpatched_count":13,"last_vuln_date":192,"fetched_at":30},"checkfront-wp-booking","Checkfront Online Booking System","3.7","checkfront","https:\u002F\u002Fprofiles.wordpress.org\u002Fcheckfront\u002F","\u003Cp>\u003Cstrong>Checkfront\u003C\u002Fstrong> is an \u003Ca href=\"https:\u002F\u002Fwww.checkfront.com?cfcp=wp\" rel=\"nofollow ugc\">Online Booking System\u003C\u002Fa> designed for your tour, activity, rental or accommodation business. Checkfront helps streamline the reservation process and grow your business by allowing you to manage availability and inventory, learn about your customers, automate communications, access valuable insights, and plan your day to day operations.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Your guests\u003C\u002Fstrong> can view your availability and book directly from your WordPress website at whatever time suits them. They can easily submit their details, sign digital waivers and documents, review their booking history, and make an online payment — all from a desktop or mobile device.\u003C\u002Fp>\n\u003Cp>This plugin provides a powerful \u003Cstrong>real-time booking interface\u003C\u002Fstrong> that blends in with your existing WordPress theme by connecting your Checkfront account to your WordPress site.\u003C\u002Fp>\n\u003Ch3>Features include\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Display real time availability, \u003Ca href=\"https:\u002F\u002Fwww.checkfront.com?cfcp=wp\" rel=\"nofollow ugc\">take reservations, bookings and process payments\u003C\u002Fa> online within your website\u003C\u002Fli>\n\u003Cli>Automatically send confirmations, alerts, invoices, and customized follow-up to customers, staff and partners\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.checkfront.com\u002Fintroducing-guest-form?cfcp=wp\" rel=\"nofollow ugc\">Collect information\u003C\u002Fa> for each participant with Guest Form and plan your day in advance with the Daily Agenda\u003C\u002Fli>\n\u003Cli>Over 50 additional integrations including \u003Ca href=\"https:\u002F\u002Fwww.checkfront.com\u002Faddons?cfcp=wp\" rel=\"nofollow ugc\">MailChimp, Zoho, Google Apps, Xero, and Twilio SMS\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Create Customer Accounts for customers to review booking history, store autofill details and (optionally) modify future bookings from a personal login\u003C\u002Fli>\n\u003Cli>Sync your availability with OTAs like Viator, Expedia and TripAdvisor\u003C\u002Fli>\n\u003Cli>Detailed analytics and reporting\u003C\u002Fli>\n\u003Cli>Track third-party referrals and commissions with Partner Accounts\u003C\u002Fli>\n\u003Cli>Responsive, mobile-friendly booking process and back-end\u003C\u002Fli>\n\u003Cli>Support for multiple languages and international currencies\u003C\u002Fli>\n\u003Cli>Multi-gateway payment processing including Stripe, Square, Paypal, Authorize.net, SagePay & dozens more\u003C\u002Fli>\n\u003Cli>SSL support keeps the customer on your website while making payment\u003C\u002Fli>\n\u003Cli>Support for shortcodes, or custom theme pages in WordPress.\u003C\u002Fli>\n\u003Cli>Tailored onboarding session and a 24\u002F7 support team\u003C\u002Fli>\n\u003Cli>\u003Cstrong>No commissions!\u003C\u002Fstrong>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Checkfront integrates seamlessly into WordPress and does not force customers off to an external website to process bookings or view availability. Checkfront keeps consumer data secure and separate from WordPress.\u003C\u002Fp>\n\u003Cp>The combined CMS features of WordPress with the power, flexibility and security of the Checkfront back-end make for an industry leading booking management system.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fvimeo.com\u002F108589695\" rel=\"nofollow ugc\">See Checkfront and WordPress in action here.\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Installation\u003C\u002Fh3>\n\u003Col>\n\u003Cli>Install the Checkfront Booking plugin in your WordPress admin by going to \u003Cem>‘Plugins \u002F Add New’\u003C\u002Fem> and  searching for \u003Cem>‘Checkfront’\u003C\u002Fem>,  \u003Cstrong>(or)\u003C\u002Fstrong> If doing a manual install, download the plugin and unzip into your \u003Ccode>\u002Fwp-content\u002Fplugins\u002F\u003C\u002Fcode> directory \u003C\u002Fli>\n\u003Cli>Activate the the plugin through the ‘Plugins’ menu in WordPress\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Configuration\u003C\u002Fh3>\n\u003Col>\n\u003Cli>Create your \u003Ca href=\"https:\u002F\u002Fwww.checkfront.com\u002Fstart\u002F?cfcp=wp\" title=\"Checkfront Setup\" rel=\"nofollow ugc\">Checkfront account\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Setup you inventory and configure your account on Checkfront\u003C\u002Fli>\n\u003Cli>Enable the Checkfront booking search widget in WordPress\u003C\u002Fli>\n\u003Cli>Create a WordPress \u003Cstrong>Post\u003C\u002Fstrong> and embed the Checkfront booking system by using the shortcode: \u003Ccode>[checkfront]\u003C\u002Fcode> (see the plugin for more options to pass to the shortcode)\u003C\u002Fli>\n\u003Cli>If you wish to use a theme template instead of a shortcode, see the checkfront-custom-temp late-sample.php provided with the plugin\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Frequently Asked Questions\u003C\u002Fh3>\n\u003Col>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.checkfront.com\u002Fwordpress\u002F#faq\" rel=\"nofollow ugc\">Checkfront WordPress FAQ\u003C\u002Fa> \u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.checkfront.com\u002Ffaq?cfcp=wp\" rel=\"nofollow ugc\">General Checkfront FAQ\u003C\u002Fa> \u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.checkfront.com\u002Fsupport?cfcp=wp\" rel=\"nofollow ugc\">Additional Support and Documenation\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Screenshots\u003C\u002Fh3>\n\u003Col>\n\u003Cli>Checkfront Dashboard\u003C\u002Fli>\n\u003Cli>WordPress code generator within Checkfront\u003C\u002Fli>\n\u003Cli>Booking Interface integrated into WordPress\u003C\u002Fli>\n\u003Cli>Booking Interface within Checkfront\u003C\u002Fli>\n\u003Cli>Checkfront Guest Form\u003C\u002Fli>\n\u003C\u002Fol>\n","The Premier Wordpress Plugin for Easy Online Booking of Tours, Activities, Rentals & Accommodations.",2000,99213,82,12,"2023-11-09T23:03:00.000Z","6.4.8","2.0",[20,99,187,21,188],"online-booking","reservation-system","https:\u002F\u002Fwww.checkfront.com\u002Fwordpress","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcheckfront-wp-booking.zip",85,"2023-09-21 00:00:00",{"attackSurface":194,"codeSignals":217,"taintFlows":268,"riskAssessment":331,"analyzedAt":346},{"hooks":195,"ajaxHandlers":209,"restRoutes":210,"shortcodes":211,"cronEvents":216,"entryPointCount":28,"unprotectedCount":13},[196,201,205],{"type":197,"name":198,"callback":199,"file":49,"line":200},"action","admin_init","register_planyo_settings",31,{"type":197,"name":202,"callback":203,"file":49,"line":204},"admin_menu","planyo_menu",203,{"type":197,"name":206,"callback":207,"file":49,"line":208},"init","planyo_init",206,[],[],[212],{"tag":213,"callback":214,"file":49,"line":215},"planyo","planyo_code",277,[],{"dangerousFunctions":218,"sqlUsage":219,"outputEscaping":221,"fileOperations":27,"externalRequests":28,"nonceChecks":13,"capabilityChecks":13,"bundledLibraries":267},[],{"prepared":13,"raw":13,"locations":220},[],{"escaped":13,"rawEcho":222,"locations":223},22,[224,227,229,231,233,235,237,239,241,243,245,247,249,251,253,254,256,258,260,262,264,266],{"file":48,"line":225,"context":226},126,"raw output",{"file":48,"line":228,"context":226},145,{"file":48,"line":230,"context":226},163,{"file":48,"line":232,"context":226},212,{"file":48,"line":234,"context":226},213,{"file":48,"line":236,"context":226},214,{"file":48,"line":238,"context":226},215,{"file":48,"line":240,"context":226},216,{"file":48,"line":242,"context":226},217,{"file":48,"line":244,"context":226},218,{"file":48,"line":246,"context":226},219,{"file":48,"line":248,"context":226},225,{"file":48,"line":250,"context":226},233,{"file":48,"line":252,"context":226},244,{"file":48,"line":252,"context":226},{"file":48,"line":255,"context":226},255,{"file":49,"line":257,"context":226},48,{"file":49,"line":259,"context":226},50,{"file":49,"line":261,"context":226},130,{"file":49,"line":263,"context":226},171,{"file":51,"line":265,"context":226},128,{"file":51,"line":261,"context":226},[],[269,285,322],{"entryPoint":270,"graph":271,"unsanitizedCount":28,"severity":68},"planyo_output_resource_details (planyo-plugin-impl.php:149)",{"nodes":272,"edges":283},[273,278],{"id":274,"type":275,"label":276,"file":48,"line":277},"n0","source","$_SERVER",153,{"id":279,"type":280,"label":281,"file":48,"line":230,"wp_function":282},"n1","sink","echo() [XSS]","echo",[284],{"from":274,"to":279,"sanitized":53},{"entryPoint":286,"graph":287,"unsanitizedCount":321,"severity":68},"\u003Culap> (ulap.php:0)",{"nodes":288,"edges":314},[289,291,292,295,297,299,303,308,310,312],{"id":274,"type":275,"label":290,"file":51,"line":265},"$_POST['ulap_url']",{"id":279,"type":280,"label":281,"file":51,"line":265,"wp_function":282},{"id":293,"type":275,"label":294,"file":51,"line":261},"n2","$_GET['ulap_url']",{"id":296,"type":280,"label":281,"file":51,"line":261,"wp_function":282},"n3",{"id":298,"type":275,"label":290,"file":51,"line":265},"n4",{"id":300,"type":301,"label":302,"file":51,"line":265},"n5","transform","→ send_http_post()",{"id":304,"type":280,"label":305,"file":51,"line":306,"wp_function":307},"n6","fopen() [File Access]",105,"fopen",{"id":309,"type":275,"label":294,"file":51,"line":261},"n7",{"id":311,"type":301,"label":302,"file":51,"line":261},"n8",{"id":313,"type":280,"label":305,"file":51,"line":306,"wp_function":307},"n9",[315,316,317,318,319,320],{"from":274,"to":279,"sanitized":53},{"from":293,"to":296,"sanitized":53},{"from":298,"to":300,"sanitized":53},{"from":300,"to":304,"sanitized":53},{"from":309,"to":311,"sanitized":53},{"from":311,"to":313,"sanitized":53},4,{"entryPoint":323,"graph":324,"unsanitizedCount":28,"severity":330},"\u003Cplanyo-plugin-impl> (planyo-plugin-impl.php:0)",{"nodes":325,"edges":328},[326,327],{"id":274,"type":275,"label":276,"file":48,"line":277},{"id":279,"type":280,"label":281,"file":48,"line":230,"wp_function":282},[329],{"from":274,"to":279,"sanitized":53},"low",{"summary":332,"deductions":333},"The 'planyo-online-reservation-system' plugin v3.0 exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and has no identified critical or high severity vulnerabilities in its static analysis, several significant concerns remain. The complete lack of proper output escaping across all identified output points is a major red flag, leaving the plugin highly susceptible to Cross-Site Scripting (XSS) attacks. Furthermore, the absence of nonce checks and capability checks on its entry points (even though the attack surface is currently small) means that any future introduction of new handlers or features could introduce vulnerabilities if not carefully secured. The plugin also has a history of a medium severity Cross-Site Scripting vulnerability, with one currently unpatched. This pattern, coupled with the current lack of output escaping, suggests a potential ongoing weakness in how user-provided data is handled, which could be exploited if an attacker finds a way to inject malicious scripts.",[334,337,339,341,343],{"reason":335,"points":336},"Unpatched medium CVE",15,{"reason":338,"points":336},"Output escaping 0%",{"reason":340,"points":105},"No nonce checks",{"reason":342,"points":105},"No capability checks",{"reason":344,"points":345},"Flows with unsanitized paths",5,"2026-03-16T19:47:35.741Z",{"wat":348,"direct":359},{"assetPaths":349,"generatorPatterns":354,"scriptPaths":355,"versionParams":356},[350,351,352,353],"\u002Fwp-content\u002Fplugins\u002Fplanyo-online-reservation-system\u002Fplanyo.css","\u002Fwp-content\u002Fplugins\u002Fplanyo-online-reservation-system\u002Fplanyo_admin.css","\u002Fwp-content\u002Fplugins\u002Fplanyo-online-reservation-system\u002Fplanyo.js","\u002Fwp-content\u002Fplugins\u002Fplanyo-online-reservation-system\u002Fplanyo_admin.js",[],[],[357,358],"planyo-online-reservation-system\u002Fplanyo.css?ver=","planyo-online-reservation-system\u002Fplanyo.js?ver=",{"cssClasses":360,"htmlComments":367,"htmlAttributes":380,"restEndpoints":388,"jsGlobals":389,"shortcodeOutput":392},[361,362,363,364,365,366],"planyo_search_fields","planyo_calendar","planyo_reservation_box","planyo_availability_box","planyo_resource_list","planyo_login_form",[368,369,370,371,372,373,374,375,376,377,378,379],"Copyright 2015 Xtreeme GmbH  (email : planyo@xtreeme.com)","This program is free software; you can redistribute it and\u002For modify","it under the terms of the GNU General Public License as published by","the Free Software Foundation; either version 2 of the License, or","(at your option) any later version.","This program is distributed in the hope that it will be useful,","but WITHOUT ANY WARRANTY; without even the implied warranty of","MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the","GNU General Public License for more details.","You should have received a copy of the GNU General Public License","along with this program; if not, write to the Free Software","Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA",[381,382,383,384,385,386,387],"planyo-site-id","planyo-language","planyo-default-mode","planyo-resource-id","planyo-date","planyo-calendar-height","planyo-calendar-width",[],[390,391],"planyo_obj","planyo_data",[393,394,395,396,397,398,399,400],"[planyo","[planyo plugin_path=","[planyo resource_id=","[planyo language=","[planyo date=","[planyo default_mode=","[planyo calendar_height=","[planyo calendar_width=",{"error":402,"url":403,"statusCode":404,"statusMessage":405,"message":405},true,"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fplanyo-online-reservation-system\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":321,"versions":407},[408,415,424,433],{"version":6,"download_url":409,"svn_tag_url":410,"released_at":38,"has_diff":53,"diff_files_changed":411,"diff_lines":38,"trac_diff_url":412,"vulnerabilities":413,"is_current":402},"https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fplanyo-online-reservation-system.3.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fplanyo-online-reservation-system\u002Ftags\u002F3.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fplanyo-online-reservation-system%2Ftags%2F2.9&new_path=%2Fplanyo-online-reservation-system%2Ftags%2F3.1",[414],{"id":64,"url_slug":65,"title":66,"severity":68,"cvss_score":69,"vuln_type":71,"patched_in_version":38},{"version":416,"download_url":417,"svn_tag_url":418,"released_at":38,"has_diff":53,"diff_files_changed":419,"diff_lines":38,"trac_diff_url":420,"vulnerabilities":421,"is_current":53},"2.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fplanyo-online-reservation-system.2.9.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fplanyo-online-reservation-system\u002Ftags\u002F2.9\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fplanyo-online-reservation-system%2Ftags%2F2.7&new_path=%2Fplanyo-online-reservation-system%2Ftags%2F2.9",[422,423],{"id":64,"url_slug":65,"title":66,"severity":68,"cvss_score":69,"vuln_type":71,"patched_in_version":38},{"id":34,"url_slug":35,"title":36,"severity":40,"cvss_score":41,"vuln_type":43,"patched_in_version":6},{"version":425,"download_url":426,"svn_tag_url":427,"released_at":38,"has_diff":53,"diff_files_changed":428,"diff_lines":38,"trac_diff_url":429,"vulnerabilities":430,"is_current":53},"2.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fplanyo-online-reservation-system.2.7.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fplanyo-online-reservation-system\u002Ftags\u002F2.7\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fplanyo-online-reservation-system%2Ftags%2F2.6&new_path=%2Fplanyo-online-reservation-system%2Ftags%2F2.7",[431,432],{"id":64,"url_slug":65,"title":66,"severity":68,"cvss_score":69,"vuln_type":71,"patched_in_version":38},{"id":34,"url_slug":35,"title":36,"severity":40,"cvss_score":41,"vuln_type":43,"patched_in_version":6},{"version":434,"download_url":435,"svn_tag_url":436,"released_at":38,"has_diff":53,"diff_files_changed":437,"diff_lines":38,"trac_diff_url":38,"vulnerabilities":438,"is_current":53},"2.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fplanyo-online-reservation-system.2.6.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fplanyo-online-reservation-system\u002Ftags\u002F2.6\u002F",[],[439,440],{"id":64,"url_slug":65,"title":66,"severity":68,"cvss_score":69,"vuln_type":71,"patched_in_version":38},{"id":34,"url_slug":35,"title":36,"severity":40,"cvss_score":41,"vuln_type":43,"patched_in_version":6}]