CVE-2020-9371: XSS
First published: Wed Mar 04 2020(Updated: )
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CodePeople Appointment Hour Booking | <1.3.35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html
- https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9
- https://wordpress.org/plugins/appointment-booking-calendar/#developers
- https://wpvulndb.com/vulnerabilities/10110
- https://www.hotdreamweaver.com/support/view.php?id=815925
Frequently Asked Questions
What is the severity of CVE-2020-9371?
CVE-2020-9371 is considered a high severity vulnerability due to its potential for stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2020-9371?
To fix CVE-2020-9371, update the Appointment Booking Calendar plugin to version 1.3.35 or later.
What impact does CVE-2020-9371 have on WordPress sites?
CVE-2020-9371 allows attackers to inject malicious JavaScript or HTML code, potentially compromising users' data and sessions.
Which versions of the Appointment Booking Calendar plugin are affected by CVE-2020-9371?
CVE-2020-9371 affects all versions of the Appointment Booking Calendar plugin prior to 1.3.35.
Is any user action required if I am using the updated version of the Appointment Booking Calendar plugin?
If you are using version 1.3.35 or later of the Appointment Booking Calendar plugin, no further action is required regarding CVE-2020-9371.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/codepeople
- canonical/codepeople appointment hour booking