Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-1007

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
3.7%
top 12.08%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unknown Advanced Booking CalendarElbtide Advanced Booking Calendar
Timeline
PublishedApr 11
Latest updateApr 12

Description

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/advanced_booking_calendar1.7.1 — 1.7.1

Patches

Patch: plugins.trac.wordpress.org ↗Patch: wpscan.com ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-84jw-8ppw-fjwr: The Advanced Booking Calendar WordPress plugin before 1↗2022-04-12
▶
CVEList
Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting↗2022-04-11
▶

💥Exploits & PoCs

1
Nuclei
WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting
▶