CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2567 – Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2567
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El plugin Form Builder CP de WordPress versiones anteriores a 1.2.32, no sanea y escapa de algunas de sus configuraciones de formularios, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio) The Form Builder CP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/dfa21dde-a9fc-4a35-9602-c3fde907ca54 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0389 – WP Time Slots Booking Form < 1.1.63 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0389
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. El plugin WP Time Slots Booking Form de WordPress versiones anteriores a 1.1.63, no sanea ni escapa de los nombres de los calendarios, permitiendo a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html no está permitida • https://wpscan.com/vulnerability/788ead78-9aa2-49a3-b191-12114be8270b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42361 – Contact Form Email <= 1.3.24 Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-42361
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. El plugin de WordPress Contact Form Email es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado, debido a una comprobación de entrada insuficiente y al escape por medio del parámetro name encontrado en el archivo ~/trunk/cp-admin-int-list.inc.php que permitía a atacantes con un usuario administrativo acceso para inyectar scripts web arbitrarios, en versiones hasta la 1.3.24 incluyéndola. Esto afecta a las instalaciones de varios sitios donde unfiltered_html está inhabilitado para los administradores y a los sitios donde unfiltered_html está inhabilitado • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2628041%40contact-form-to-email&new=2628041%40contact-form-to-email&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42361 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2020-9371 – Appointment Booking Calendar <= 1.3.34 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-9371
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML. Una vulnerabilidad de tipo XSS almacenado, se presenta en el plugin Appointment Booking Calendar versiones anteriores a 1.3.35 para WordPress. En el archivo cpabc_appointments.php, la entrada Calendar Name podría permitir a atacantes inyectar JavaScript o HTML arbitrario. WordPress Appointment Booking Calendar plugin version 1.3.34 suffers from a CSV injection vulnerability. • https://www.exploit-db.com/exploits/48204 http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9 https://wordpress.org/plugins/appointment-booking-calendar/#developers https://wpvulndb.com/vulnerabilities/10110 https://www.hotdreamweaver.com/support/view.php?id=815925 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 3CVE-2020-9372 – Appointment Booking Calendar <= 1.3.34 - CSV Injection
https://notcve.org/view.php?id=CVE-2020-9372
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection. El plugin Appointment Booking Calendar versiones anteriores a 1.3.35 para WordPress, permite que la entrada de usuario sea cualquier fórmula (en campos tales como Description o Name) en cualquier formulario de reserva, que luego podría ser exportado por medio de la pestaña Bookings list en /wp-admin/admin.php?page=cpabc_appointments.php. • https://www.exploit-db.com/exploits/48204 http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9 https://wordpress.org/plugins/appointment-booking-calendar/#developers https://www.hotdreamweaver.com/support/view.php?id=815925 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •