CVE-2020-24313 – Ultimate Appointment Booking & Scheduling < 1.1.10 - Reflected Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2020-24313

10 Aug 2020 — Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL. Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin versiones v1.1.9 y anteriores, no sanea el valor del parámetro GET "Appointment_ID" antes de repetirlo dentro de una eti... • https://wordpress.org/plugins/ultimate-appointment-scheduling • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •