Bylancer Bookme vulnerabilities

• bylancer bookme – free online appointment booking and scheduling plugin Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter CVE-2025-13385 4.9 MediumNovember 25, 2025
• bylancer bookme Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me"... CVE-2018-8737 5.4 MediumMarch 17, 2018