CVE-2020-9371

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

Recent assessments:

kevthehermit at March 05, 2020 10:29am UTC reported:

This plugin is currently listed as having over 5000 active installations and a little over 3 hundred thousand downloads.

The ability to add an XSS payload is only available when creating or updating calendars which is an admin level feature, this means it is unlikely to be valuable to an attacker as if they already have this level of access there are more damaging attacks that can be performed.

Assessed Attacker Value: 1
Assessed Attacker Value: 1Assessed Attacker Value: 5