HTML Injection Flaws in Availability Booking Calendar by WordPress
CVE-2023-48825

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Availability Booking Calendar
Vendor
CVE Published:
7 December 2023

What is CVE-2023-48825?

Availability Booking Calendar version 5.0 contains multiple HTML injection vulnerabilities that can be exploited via the SMS API Key or Default Country Code fields. These flaws allow attackers to inject malicious HTML content, potentially compromising the functionality of the web application and impacting user data integrity. Users of the affected version are advised to assess their implementations and consider available patches to secure their systems.

References

http://packetstormsecurity.com/files/176033

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.