medium4.8Public exploit code
CVE-2020-9371
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection2020-03-12 · webapps · php
Impact
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Codepeople | Appointment Booking Calendar | before 1.3.35 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html
- https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9
- https://wordpress.org/plugins/appointment-booking-calendar/#developers
- https://wpvulndb.com/vulnerabilities/10110
- https://www.hotdreamweaver.com/support/view.php?id=815925
- http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html
- https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9
- https://wordpress.org/plugins/appointment-booking-calendar/#developers
- https://wpvulndb.com/vulnerabilities/10110
- https://www.hotdreamweaver.com/support/view.php?id=815925