8759 matches found
WordPress booking-calendar plugin cross-site scripting vulnerability (CNVD-2018-01251)
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site scripting vulnerability exists ...
CVE-2018-5672
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...
CVE-2018-5671
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...
CVE-2018-5671
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...
CVE-2018-5673
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
CVE-2018-5672
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...
CVE-2018-5673
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
Cross site request forgery (csrf)
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
CVE-2018-5670
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...
Design/Logic Flaw
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...
Design/Logic Flaw
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...
CVE-2018-5670
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...
Design/Logic Flaw
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...
CVE-2018-5673
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
CVE-2018-5670
CVE-2018-5670 affects the WordPress booking-calendar plugin up to version 2.1.7. The issue is an XSS in wp-admin/admin.php via the sale_conditions[count][] parameter, as reported across sources (NVD, CNVD, CVE listings). Some records describe this as an authenticated stored XSS with CSRF (WPVulnd...
CVE-2018-5671
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...
CVE-2018-5672
CVE-2018-5672 affects the WordPress booking-calendar plugin, version 2.1.7. It exposes a stored XSS via the wp-admin/admin.php form_field5[label] parameter, as described across CNVD/NVD entries. Exploitation could allow an attacker to obtain a user cookie or perform a malicious action; the inform...
CVE-2018-5673
The CVE-2018-5673 entry concerns the WordPress Booking Calendar plugin prior to v2.1.8, where a CSRF vulnerability exists in wp-admin/admin.php for plugin 2.1.7. The NVD entry records CSRF with CVSS v2 base 6.8 (Medium) and CVSS v3 base 8.8 (High). Connected sources also describe an authenticated...
CVE-2018-5671
CVE-2018-5671 affects the WordPress plugin booking-calendar 2.1.7 . The issue is a stored XSS vulnerability exploitable via the request parameter wp-admin/admin.php?extra_field1[items][field_item1][price_percent] . The available sources describe the vulnerability path but do not provide specific ...