CVE-2023-27918

2023-05-1000:00:00

jpcert

www.cve.org

cve-2023-27918

cross-site scripting

appointment and event booking calendar

wordpress

remote unauthenticated attacker

arbitrary script

malicious url

0.002 Low

EPSS

Percentile

57.6%

JSON

Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.

CNA Affected

[
  {
    "vendor": "TMS",
    "product": "Appointment and Event Booking Calendar for WordPress - Amelia",
    "versions": [
      {
        "version": "versions prior to 1.0.76",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN00971105/

wordpress.org/plugins/ameliabooking/#developers

0.002 Low

EPSS

Percentile

57.6%

JSON

Related for CVELIST:CVE-2023-27918