1 vulnerability across 1 product scored HIGH or above on November 01, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] liquid_web_/_stellarwp/bookit

1 CVE | CVSS 3.1: 9.3 | AAS 10.3

  • cpe:2.3:a:liquid_web_stellarwp:bookit:*:*:*:*:*:*:*:* (< 2.6.0.7)

Liquid Web / StellarWP BookIt, a WordPress appointment booking plugin, is affected by one critical SQL injection vulnerability (CVE-2026-62048, CVSS 9.3 HIGH) in all versions through 2.6.0.6. This flaw allows attackers to inject malicious SQL commands, potentially leading to unauthorized database access, data exfiltration, or full site compromise, and is considered exploitable.

WordPress site administrators using the BookIt plugin should update immediately beyond version 2.6.0.6 and review database logs for signs of exploitation. Consult the vendor advisory at Patchstack for patch details and additional guidance.

Vendor Advisory