Lucene search
PRIOn knowledge basePRION:CVE-2023-2707HistoryNov 27, 2023 - 5:15 p.m.
Cross site scripting
2023-11-2717:15:00
PRIOn knowledge base
www.prio-n.com
3
gappointments
plugin
wordpress
stored
cross-site scripting
attacks
settings
high privilege users
admin
unfiltered_html capability
multisite setup
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
| CPE | Name | Operator | Version |
|---|---|---|---|
| gappointments | le | 1.9.5.1 |
Related
cve
cve
CVE-2023-2707
2023-11-27 17:15:07
cvelist
cvelist
wpexploit
wpexploit
Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS
2023-10-31 00:00:00
wpvulndb
wpvulndb
Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS
2023-10-31 00:00:00
nvd
nvd
CVE-2023-2707
2023-11-27 17:15:07