Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
CVE-2021-24225

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Advanced Booking Calendar
Vendor
CVE Published:
12 April 2021

What is CVE-2021-24225?

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

Affected Version(s)

Advanced Booking Calendar 1.6.7

References

https://wpscan.com/vulnerability/25ca8af5-ab48-4e6d-b2ef-...
x_refsource_CONFIRM
https://plugins.trac.wordpress.org/changeset/2503971/
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iohex
.