Privilege Escalation and XSS in Booking Calendar Contact Form by WordPress
CVE-2016-20070

5.1MEDIUM

Key Information:

Vendor: WordPress
Status: Booking Calendar Contact Form
Vendor: CVE Published:; 15 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20070?

The Booking Calendar Contact Form 1.0.23 plugin for WordPress is susceptible to privilege escalation and stored XSS vulnerabilities. These flaws arise from inadequate verification of user privileges and insufficient input sanitation. An attacker with subscriber-level credentials can exploit these vulnerabilities by injecting malicious scripts through parameters such as price, name, calendar_language, and email_confirmation_to_user via the admin-ajax.php and admin.php endpoints. This can lead to the execution of arbitrary JavaScript in the browsers of administrators, compromising the security of the application.

Affected Version(s)

Booking Calendar Contact Form 0 <= 1.0.23

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20070 - Proof of Concept