CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4034 – Appointment Hour Booking <= 1.3.72 - CSV Injection
https://notcve.org/view.php?id=CVE-2022-4034
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. El complemento Appointment Hour Booking para WordPress es vulnerable a la inyección CSV en versiones hasta la 1.3.72 incluida. Esto hace posible que atacantes no autenticados incorporen entradas no confiables en contenido durante la creación de reservas que pueden exportarse como un archivo CSV cuando el administrador de un sitio exporta los detalles de la reserva. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4034 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4035 – Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form
https://notcve.org/view.php?id=CVE-2022-4035
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page. El complemento Appointment Hour Booking para WordPress es vulnerable a la inyección de iFrame a través del correo electrónico o parámetros de campo generales en versiones hasta la 1.3.72 incluida debido a una sanitización de entrada y un escape de salida insuficientes que hacen posible la inyección de etiquetas iFrame. Esto hace posible que atacantes no autenticados inyecten iFrames al enviar una reserva que se ejecutará cada vez que un usuario acceda a la página de detalles de la reserva inyectada. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4035 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4036 – Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
https://notcve.org/view.php?id=CVE-2022-4036
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie. El complemento Appointment Hour Booking para WordPress es vulnerable a la omisión de CAPTCHA en versiones hasta la 1.3.72 incluida. Esto se debe al uso de un algoritmo hash insuficientemente potente en el secreto del CAPTCHA, que también se muestra al usuario a través de una cookie. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4036 • CWE-326: Inadequate Encryption Strength CWE-804: Guessable CAPTCHA •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41692 – WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability
https://notcve.org/view.php?id=CVE-2022-41692
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. Vulnerabilidad de autorización faltante en el complemento Appointment Hour Booking en WordPress en versiones <= 1.3.71. The Appointment Hour Booking plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the cpapphb_feedback function in versions up to, and including, 1.3.71. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to provide plugin feedback. • https://patchstack.com/database/vulnerability/appointment-hour-booking/wordpress-appointment-hour-booking-plugin-1-3-71-missing-authorization-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1710 – Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1710
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. El plugin Appointment Hour Booking para WordPress versiones anteriores a 1.3.56, no sanea y escapa de una configuración de sus campos de Calendario, lo que podría permitir a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando el unfiltered_html no está permitido • https://wpscan.com/vulnerability/ed162ccc-88e6-41e8-b24d-1b9f77a038b6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •