CVE-2022-1007

MEDIUMNuclei

Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1007 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Advanced Booking Calendar

CVE List1.7.1 to < 1.7.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Advanced Booking Calendar <1.7.1 - Cross-Site ScriptingCVSS 6.1

WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user.

Remediation

Update to WordPress Advanced Booking Calendar plugin version 1.7.1 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authors8arthur
Template tagscvecve2022wp-pluginadvanced-booking-calendarwpauthenticatedwpscanwordpressxsselbtidevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:elbtide:advanced_booking_calendar:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6f5b764b-d13b-4371-9cc5-91204d9d6358 https://wordpress.org/plugins/advanced-booking-calendar/ https://nvd.nist.gov/vuln/detail/cve-2022-1007 https://plugins.trac.wordpress.org/changeset/2695427 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3