CVE-2022-1007

The CVE-2022-1007 entry corresponds to a vulnerability in the WordPress plugin Advanced Booking Calendar (versions before 1.7.1). The issue is a Reflected Cross-Site Scripting (XSS) where the room parameter is not sanitized/escaped before being echoed in an admin page, allowing an attacker to inj...

CVE-2022-0694

The CVE-2022-0694 entry concerns the WordPress plugin Advanced Booking Calendar before v1.7.0. The vulnerability is an unauthenticated SQL injection arising because abc_booking_getSingleCalendar does not validate or escape the calendar parameter before using it in a SQL statement, and the AJAX ac...

CVE-2022-1006

CVE-2022-1006 affects the WordPress plugin Advanced Booking Calendar prior to version 1.7.1. The vulnerability stems from the plugin not sanitising or escaping the id parameter when editing calendars, enabling high-privilege users (e.g., admins) to perform SQL injection. The issue is documented a...

CVE-2022-45822

The CVE-2022-45822 entry concerns an unauthenticated SQL Injection in the WordPress plugin Advanced Booking Calendar up to version 1.7.1 . The root cause, as documented in connected sources, is improper sanitisation/escaping of a parameter used in a SQL statement, enabling unauthenticated users t...

CVE-2021-24225

CVE-2021-24225 affects the WordPress plugin Advanced Booking Calendar (pre-1.6.7). The vulnerability is an authenticated, reflected XSS caused by not sanitising the calId GET parameter on the Seasons & Calendars page, with output in an A tag. Exploitation details and PoCs exist in connected sourc...

CVE-2022-45824

CVE-2022-45824 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Advanced Booking Calendar, version 1.7.1 and earlier. Multiple sources confirm missing CSRF checks in certain areas, enabling an attacker to trick an authenticated user into performing unintended ac...

CVE-2021-24232

CVE-2021-24232 affects the WordPress plugin Advanced Booking Calendar prior to 1.6.8. The root cause is failure to sanitize the license error message output on the settings page, enabling an authenticated reflected XSS. The vulnerability affects the plugin’s settings handling and can be triggered...