CVE-2022-1007: vulnerability in Advanced Booking Calendar
Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting
Published · Updated
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 1.9%
exploitation probability
1.9%top 21% of all CVEs
observed exploitation
nono source reports it
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Affected products
Unknown · Advanced Booking CalendarRelated CVEs — Advanced Booking Calendar
In the same product, most dangerous first.
CVE-2022-0694—Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL InjectionEPSS 1.8%CVE-2022-1006—Advanced Booking Calendar < 1.7.1 - Admin+ SQLiEPSS 1.5%CVE-2021-24225—Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.7%CVE-2021-24232—Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%