CVE-2021-24225CWE-79

Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)

published April 12, 2021

CVSS
—
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00691 · 52.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-04-12T14:04Z
EPSS history
Timeline
  • 12 APR 14:04Z
    Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
    cvelistv5