Advanced Booking Calendar < 1.7.1 – Reflected Cross-Site Scripting | CVE 2022-1007 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/wp-admin/admin.php?page=advanced-booking-calendar-show-seasons-calendars&setting=changeSaved&room=1111%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C%22

Affects Plugins

advanced-booking-calendar

Fixed in 1.7.1

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2695427

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

YICHENG LIU-ZTE CHENFENG lab

Submitter

YICHENG LIU-ZTE CHENFENG lab

Verified

Yes

WPVDB ID

6f5b764b-d13b-4371-9cc5-91204d9d6358

Timeline

Publicly Published

2022-03-21 (about 3 years ago)

Added

2022-03-21 (about 3 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2023-11-29

Title

BrainCert – HTML5 Virtual Classroom < 2.2 - Reflected Cross-Site Scripting

Published

2025-02-19

Title

Ultimate Classified Listings < 1.5 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter

Published

2024-03-01

Title

Master Slider < 3.10.0 - Contributor+ Stored XSS

Published

2023-09-25

Title

Stagtools < 2.3.8 - Reflected XSS

Published

2014-08-01

Title

Feedweb 2.4 - DOM Cross-Site Scripting (XSS)