CVE-2022-4035CWE-79

Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form

High · published November 29, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00747 · 54.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-11-29T20:32Z
EPSS history
Timeline
  • 29 NOV 20:32Z
    Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form
    cvelistv5