CVE-2016-20070

EIP tracks 1 public exploit for CVE-2016-20070. PoCs published by i0akiN SEC-LABORATORY.

AI-analyzed exploit summary The exploit demonstrates unauthenticated blind SQL injection and stored XSS vulnerabilities in WordPress Booking Calendar Contact Form plugin <=v1.0.23. It includes detailed technical analysis, vulnerable function paths, and proof-of-concept payloads for SQLi and XSS attacks.

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.