CVE-2022-4035: Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-4035?
CVE-2022-4035 is a vulnerability in the Appointment Hour Booking plugin for WordPress that allows for iFrame Injection via the 'email' or general field parameters.
What software versions are affected by CVE-2022-4035?
Versions up to and including 1.3.72 of the Appointment Hour Booking plugin for WordPress are affected by CVE-2022-4035.
What is the severity of CVE-2022-4035?
CVE-2022-4035 has a severity rating of 6.1 (high).
How does CVE-2022-4035 work?
CVE-2022-4035 works by exploiting insufficient input sanitization and output escaping, allowing for the injection of iFrame tags through the 'email' or general field parameters.
How can I fix CVE-2022-4035?
To fix CVE-2022-4035, update the Appointment Hour Booking plugin for WordPress to a version that is not affected by the vulnerability.