CVE-2020-24313: XSS
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "AppointmentID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-24313.
What is the severity level of CVE-2020-24313?
The severity level of CVE-2020-24313 is medium (6.1).
Which plugin version is affected by CVE-2020-24313?
Plugin version 1.1.9 and lower of Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin is affected by CVE-2020-24313.
What is the impact of CVE-2020-24313?
CVE-2020-24313 allows attackers to exploit a reflected XSS vulnerability by manipulating the "Appointment_ID" GET parameter, potentially leading to arbitrary code execution or theft of sensitive information.
Are there any fixes available for CVE-2020-24313?
At the moment, there are no publicly available fixes for CVE-2020-24313. It is recommended to disable or remove the affected plugin until a patch is released.