PT-2020-20617 · WordPress · Appointment Booking Calendar

Published 2020-03-04 · Updated 2022-10-06 · CVE-2020-9371

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar plugin versions prior to 1.3.35

Description A stored XSS issue exists, allowing attackers to inject arbitrary JavaScript or HTML through the Calendar Name input in the cpabc appointments.php file.

Recommendations For versions prior to 1.3.35, update to version 1.3.35 or later to resolve the issue. As a temporary workaround, consider restricting access to the Calendar Name input field in the cpabc appointments.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-9371

Affected Products

Appointment Booking Calendar

References · 9

• 🔥 https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9 · Exploit
• 🔥 https://exploit-db.com/exploits/48204 · Exploit
• 🔥 http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-9371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9371 · Security Note
• https://hotdreamweaver.com/support/view.php?id=815925 · Note
• https://wordpress.org/plugins/appointment-booking-calendar/#developers · Note
• https://wpvulndb.com/vulnerabilities/10110 · Note
• https://t.me/cybersecuritytechnologies/787 · Telegram Post