CVE-2020-9371: XSS
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9371?
CVE-2020-9371 is considered a high severity vulnerability due to its potential for stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2020-9371?
To fix CVE-2020-9371, update the Appointment Booking Calendar plugin to version 1.3.35 or later.
What impact does CVE-2020-9371 have on WordPress sites?
CVE-2020-9371 allows attackers to inject malicious JavaScript or HTML code, potentially compromising users' data and sessions.
Which versions of the Appointment Booking Calendar plugin are affected by CVE-2020-9371?
CVE-2020-9371 affects all versions of the Appointment Booking Calendar plugin prior to 1.3.35.
Is any user action required if I am using the updated version of the Appointment Booking Calendar plugin?
If you are using version 1.3.35 or later of the Appointment Booking Calendar plugin, no further action is required regarding CVE-2020-9371.