WordPress Hotel Booking Plugin Remote Code Execution (CVE-2020-29047)

A remote code execution vulnerability exists in WordPress Hotel Booking Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-44305)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Booking Calendar versions prior to...

CVE-2021-24232

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...

Cross site scripting

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...

CVE-2021-24232

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...

CVE-2021-24232 Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...

PT-2021-15776

Name of the Vulnerable Software and Affected Versions: Advanced Booking Calendar WordPress plugin versions prior to 1.6.8 Description: The issue is related to an authenticated reflected Cross-Site Scripting problem. This occurs because the license error message is not properly sanitized when it i...

CVE-2021-24232: Improper Neutralization of Input During Web Page Generation

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Booking Calendar versions prior to...

WordPress plugin cross-site scripting vulnerability (CNVD-2021-34527)

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Advanced Booking Calendar prior to version 1.6.7. The vulnerability stems from the plugin not clearing the GET parameter in the "Seasons and Calendars" page, an...

CVE-2021-24225

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue...

CVE-2021-24225

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue...

CVE-2021-24225

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue...

CVE-2021-24225

CVE-2021-24225 affects the WordPress plugin Advanced Booking Calendar (pre-1.6.7). The vulnerability is an authenticated, reflected XSS caused by not sanitising the calId GET parameter on the Seasons & Calendars page, with output in an A tag. Exploitation details and PoCs exist in connected sourc...

PT-2021-15769

Name of the Vulnerable Software and Affected Versions: Advanced Booking Calendar WordPress plugin versions prior to 1.6.7 Description: The issue is related to a reflected XSS problem. It occurs because the calId GET parameter in the "Seasons & Calendars" page is not properly sanitized before bein...

CVE-2021-24225: Improper Neutralization of Input During Web Page Generation

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue...

WordPress 插件跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Advanced Booking Calendar prior to version 1.6.7. The vulnerability stems from the plugin not clearing the GET parameter in the "Seasons and Calendars" page, an...

WordPress Advanced Booking Calendar plugin <= 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by iohex in WordPress Advanced Booking Calendar plugin versions = 1.6.7. Solution Update the WordPress Advanced Booking Calendar plugin to the latest available version at least 1.6.8...

Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue https://plugins.trac.wordpress.org/browser/advanced-booking-calendar/tags/1.6.7/backend/settings.phpL550...

Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue PoC Payloads: - Original reporter:...