Description (CNA)
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dwbooster / Booking Calendar Contact Form | affected 0 through 1.0.23 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/39423
- http://wordpress.dwbooster.com/
- https://www.vulncheck.com/advisories/wordpress-booking-calendar-contact-form-privilege-escalation-stored-xss
ADP enrichment
No English description supplied.
No references supplied.