4 matches found
CVE-2021-24673
CVE-2021-24673 affects the WordPress Appointment Hour Booking plugin prior to v1.3.16. The vulnerability arises from insufficient escaping in Calendar Form settings, allowing authenticated high-privilege users to perform Stored Cross-Site Scripting (XSS) even when unfiltered_html is disallowed. I...
CVE-2022-1710
The CVE-2022-1710 entry concerns the WordPress Appointment Hour Booking plugin prior to version 1.3.56. The vulnerability arises from insufficient sanitization/escaping of the Calendar fields settings, enabling stored Cross-Site Scripting (XSS) by high-privilege users. Affected component: the plu...
CVE-2021-24712
CVE-2021-24712 concerns the WordPress plugin “Appointment Hour Booking” (before 1.3.17). The root cause is inadequate sanitization of values used when creating new calendars, enabling an authenticated stored XSS attack. Impact is cross-site scripting via calendar name fields; exploitation require...