Appointment Hour Booking < 1.3.16 – Admin+ Stored Cross-Site Scripting | CVE 2021-24673 | Plugin Vulnerabilities

Description

The plugin does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Create a new Calendar (Appointment Hour Booking > Add new)
Put the following payload in the Form Settings > "Form Name" and "Description" fields: <img src onerror=alert(/XSS/)>
Click the "Save Changed and Return" button

The XSS will be triggered
- When editing the calendar again in the admin dashboard
- In posts/page where the calendar is embed

Affects Plugins

appointment-hour-booking

Fixed in 1.3.16

References

CVE

URL

https://www.hackpertise.com/cve/14-cve-2021-24673/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

75a67932-d831-4dfb-a70d-a07650eaa755

Timeline

Publicly Published

2021-09-06 (about 4 years ago)

Added

2021-09-06 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2023-11-09

Title

WP Event Manager < 3.1.43 - Reflected XSS

Published

2025-02-13

Title

Qubely – Advanced Gutenberg Blocks < 1.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'

Published

2024-04-15

Title

Shortcodes and extra features for Phlox theme < 2.15.8 - Contributor+ Stored XSS via Custom JS

Published

2021-09-21

Title

WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting

Published

2024-08-01

Title

Black Widgets For Elementor < 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting