Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting
CVE-2022-1007

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Advanced Booking Calendar
Vendor: CVE Published:; 11 April 2022

What is CVE-2022-1007?

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Affected Version(s)

Advanced Booking Calendar 1.7.1

References

https://plugins.trac.wordpress.org/changeset/2695427

x_refsource_CONFIRM

https://wpscan.com/vulnerability/6f5b764b-d13b-4371-9cc5-...

x_refsource_MISC

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 11, 2022
Vulnerability Reserved
Mar 17, 2022

Credit

YICHENG LIU-ZTE CHENFENG lab