Vulnerability Details CVE-2019-14791
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 47.6%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- https://wordpress.org/plugins/appointment-booking-calendar/#developers
- https://wpvulndb.com/vulnerabilities/9426
- https://www.pluginvulnerabilities.com/2019/07/03/hackers-look-to-be-targeting-the-wordpress-plugin-appointment-booking-calendar-which-is-yet-another-insecure-plugin-from-code-people/
- https://wordpress.org/plugins/appointment-booking-calendar/#developers
- https://wpvulndb.com/vulnerabilities/9426
- https://www.pluginvulnerabilities.com/2019/07/03/hackers-look-to-be-targeting-the-wordpress-plugin-appointment-booking-calendar-which-is-yet-another-insecure-plugin-from-code-people/
Products affected by CVE-2019-14791
-
cpe:2.3:a:codepeople:appointment_booking_calendar:1.3.18