CVE-2020-9372

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any…

published March 4, 2020

CVSS
—
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08612 · 95.1th percentile
Published
2020-03-04T18:12Z
EPSS history
Timeline
  • 04 MAR 18:12Z
    The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any…
    cvelistv5