The WordPress Booking Ultra Pro Plugin (v1.1.4 or earlier) has an unfixed high-severity XSS vulnerability, allowing malicious script injection. Other known vulnerabilities include CSRF issues.
For good reason, API Abuse has recently become a significant topic among security professionals. Large-scale data breaches have occurred in the previous two years as a result of APIs being abused and misused in some way.