Product
The WP Booking System - Booking Calendar plugin contains a vulnerability in the wpbs_action_ajax_calendar_remove_note function that allows authenticated users to delete arbitrary calendar notes due to a missing capability check.