CVE-2021-24673
04.10.2021, 12:15
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
| Vendor | Product | Version |
|---|---|---|
| dwbooster | appointment_hour_booking | 𝑥 < 1.3.16 |
𝑥
= Vulnerable software versions