CVE-2016-10916

CVE-2016-10916 affects the WordPress Appointment Booking Calendar plugin, with SQL injection in versions prior to 1.1.24. The three Red Hat/NVD/CNVD-style entries confirm an unauthenticated SQL injection vulnerability that can allow an attacker to execute arbitrary SQL commands (network access). ...

CVE-2016-10916: Improper Neutralization of Special Elements used in an SQL Command

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319...

WordPress Appointment Booking Calendar plugin cross-site scripting vulnerability (CNVD-2019-27684)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Appointment Booking Calendar is a booking plugin used in it. A cross-site scripting vulnerability exists in the WordPress Appointment...

CVE-2019-14791

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...

CVE-2019-14791

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...

CVE-2019-14791

CVE-2019-14791 affects the WordPress plugin Appointment Booking Calendar (version 1.3.18). The vulnerability is an XSS in the wp-admin/admin-post.php editionarea parameter via the cpabc_appointments_save_edition() flow, caused by lack of authorization checks for cfwpp_edit values (e.g., js or css...

CVE-2019-14791: Improper Neutralization of Input During Web Page Generation

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...

WordPress Appointment Hour Booking Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Appointment Hour Booking plugin is an online booking plugin used in it. A cross-site scripting vulnerability exists in WordPress...

WordPress Appointment Hour Booking plugin <= 1.1.45 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by ivoschyk-cs in WordPress Appointment Hour Booking plugin versions = 1.1.45. Solution Update the WordPress Appointment Hour Booking plugin to the latest available version at least 1.1.46...

CVE-2019-13505

The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email1...

CVE-2019-13505

The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email1...

Design/Logic Flaw

The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email1...

CVE-2019-13505

The CVE-2019-13505 entry concerns the WordPress Appointment Hour Booking plugin. Versions up to 1.1.45 are affected by a cross-site scripting (XSS) vulnerability in the E-mail field due to insufficient validation/handling of input, enabling malicious JavaScript execution. The issue is documented ...

CVE-2019-13505

The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email1...

CVE-2019-13505: Improper Neutralization of Input During Web Page Generation

The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email1...

PT-2019-13373 · WordPress · Appointment Hour Booking

Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking plugin version 1.1.44 Description: The issue allows for XSS via the E-mail field. Recommendations: For version 1.1.44, update to a newer version that contains a fix for this issue...

Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)

It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. PoC POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac ...

Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)

It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X...

WordPress Appointment Booking Calendar plugin <= 1.3.18 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found in WordPress Appointment Booking Calendar plugin versions = 1.3.18. Solution Update the WordPress Appointment Booking Calendar plugin to the latest available version at least 1.3.19...

Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS

Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' PoC The payload will be triggered in all pages with a booking form...