Appointment and Event Booking Calendar for WordPress < 1.0.76 - Reflected XSS

2023-04-0600:00:00

wpscan.com

wordpress

plugin

vulnerability

cross-site scripting

high privilege users

0.002 Low

EPSS

Percentile

57.6%

JSON

The plugin does not sanitise and escape the code parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CPENameOperatorVersion
ameliabookinglt1.0.76

CPE	Name	Operator	Version
	ameliabooking	lt	1.0.76

References

jvn.jp/en/jp/JVN00971105/

0.002 Low

EPSS

Percentile

57.6%

JSON

Related for WPVDB-ID:7CE4A814-4028-45B8-B4C7-2FF76F537EB2