CVE-2023-4620

🗓️ 16 Oct 2023 08:32:45Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 56 Views🌐 WEB

The Booking Calendar WordPress plugin v9.7.3.1 is vulnerable to Stored XS

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2023-4620	2 May 202518:19	–	circl
CNNVD	WordPress plugin Booking Calendar Cross-Site Scripting Vulnerability	16 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-4620 Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS	16 Oct 202308:32	–	cvelist
EUVD	EUVD-2023-54473	3 Oct 202520:07	–	euvd
NVD	CVE-2023-4620	16 Oct 202309:15	–	nvd
OSV	CVE-2023-4620	16 Oct 202309:15	–	osv
Patchstack	WordPress Booking Calendar Plugin <= 9.7.3 is vulnerable to Cross Site Scripting (XSS)	17 Oct 202300:00	–	patchstack
Prion	Cross site scripting	16 Oct 202309:15	–	prion
Positive Technologies	PT-2023-29899 · WordPress · Booking Calendar	16 Oct 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-4620	9 Jan 202612:32	–	redhatcve

NVD

Vulners

Node

wpbookingcalendar booking_calendarRange<9.7.3.1wordpress

[
  {
    "vendor": "Unknown",
    "product": "Booking Calendar",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "9.7.3.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/084e9494-2f9e-4420-9bf7-78a1a41433d7

Parameter	Position	Path	Description	CWE
firstname	request body	/wp-admin/admin.php?page=wpbc&view_days_num=90&view_mode=vm_calendar	Stored XSS via unsanitized booking data in First/Last Name fields that allows unauthenticated users to inject HTML/JS executed when an admin opens the calendar overview page.	CWE-79
lastname	request body	/wp-admin/admin.php?page=wpbc&view_days_num=90&view_mode=vm_calendar	Stored XSS via unsanitized booking data in First/Last Name fields that allows unauthenticated users to inject HTML/JS executed when an admin opens the calendar overview page.	CWE-79

17 Jun 2026 06:38Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.00475

SSVC