CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7129 – Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
https://notcve.org/view.php?id=CVE-2024-7129
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins • https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0856 – Booking Calendar < 1.3.83 - CSRF appointment scheduling
https://notcve.org/view.php?id=CVE-2024-0856
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying. The Appointment Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.82. This is due to missing or incorrect nonce validation on the cpabc_appointments.php page. This makes it possible for unauthenticated attackers to perform actions like adding bookings without paying via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a • CWE-352: Cross-Site Request Forgery (CSRF) •