CVE-2022-1007

The CVE-2022-1007 entry corresponds to a vulnerability in the WordPress plugin Advanced Booking Calendar (versions before 1.7.1). The issue is a Reflected Cross-Site Scripting (XSS) where the room parameter is not sanitized/escaped before being echoed in an admin page, allowing an attacker to inj...

CVE-2022-0694

The CVE-2022-0694 entry concerns the WordPress plugin Advanced Booking Calendar before v1.7.0. The vulnerability is an unauthenticated SQL injection arising because abc_booking_getSingleCalendar does not validate or escape the calendar parameter before using it in a SQL statement, and the AJAX ac...

CVE-2022-1006

CVE-2022-1006 affects the WordPress plugin Advanced Booking Calendar prior to version 1.7.1. The vulnerability stems from the plugin not sanitising or escaping the id parameter when editing calendars, enabling high-privilege users (e.g., admins) to perform SQL injection. The issue is documented a...

CVE-2021-24225

CVE-2021-24225 affects the WordPress plugin Advanced Booking Calendar (pre-1.6.7). The vulnerability is an authenticated, reflected XSS caused by not sanitising the calId GET parameter on the Seasons & Calendars page, with output in an A tag. Exploitation details and PoCs exist in connected sourc...

CVE-2021-24232

CVE-2021-24232 affects the WordPress plugin Advanced Booking Calendar prior to 1.6.8. The root cause is failure to sanitize the license error message output on the settings page, enabling an authenticated reflected XSS. The vulnerability affects the plugin’s settings handling and can be triggered...