Code injection

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15774

The ND Booking WordPress plugin (versions prior to 2.5 ) is vulnerable to an Unauthenticated Options Change security flaw. An unauthenticated attacker can exploit a nopriv_ AJAX action to modify the siteurl setting or other plugin options. This could allow an attacker to enable development mode, ...

PT-2019-14383

Name of the Vulnerable Software and Affected Versions nd-booking plugin versions prior to 2.5 Description The issue allows modification of the siteurl setting through a nopriv AJAX action. Recommendations For versions prior to 2.5, update the nd-booking plugin to version 2.5 or later to resolve t...

CVE-2019-15774: URL Redirection to Untrusted Site

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

WordPress appointment-booking-calendar plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. appointment-booking-calendar is an online appointment management plugin used in it. A SQL injection vulnerability exists in the...

WordPress booking-sms plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress booking-sms plugin. An attacker can exploit this...

WordPress booking-calendar-contact-form plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress booking-calendar-contact-form plugin. An attacker...

WordPress booking-calendar-contact-form plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress booking-calendar-contact-form plugin. An attacker can...

CVE-2016-10916

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319...

CVE-2013-7477

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...

Design/Logic Flaw

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...

Sql injection

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319...

CVE-2013-7480

The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas...

CVE-2013-7477

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...

CVE-2013-7477

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...

CVE-2013-7477

The CVE-2013-7477 entry concerns the WordPress Events Manager plugin, with an XSS flaw in the booking form present in versions prior to 5.5.2. Affected software: events-manager plugin for WordPress; vulnerable component: booking form input handling. Root cause per sources is an XSS vulnerability,...

CVE-2016-10916

CVE-2016-10916 affects the WordPress Appointment Booking Calendar plugin, with SQL injection in versions prior to 1.1.24. The three Red Hat/NVD/CNVD-style entries confirm an unauthenticated SQL injection vulnerability that can allow an attacker to execute arbitrary SQL commands (network access). ...

PT-2019-7026 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: events-manager plugin versions prior to 5.5.2 Description: The issue concerns a cross-site scripting XSS flaw in the booking form of the events-manager plugin. This type of flaw allows attackers to inject malicious scripts into the website,...

CVE-2016-10916: Improper Neutralization of Special Elements used in an SQL Command

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319...