EIP-2026-113596

This exploit demonstrates SQL injection and XSS vulnerabilities in the WordPress Booking Calendar plugin version 3.0.0. The PoC includes payloads for boolean-based blind, time-based blind, and UNION-based SQL injection, as well as XSS via the 'month' and 'year' parameters.