Dwbooster vulnerabilities

24 vulnerabilities

Known vulnerabilities in Dwbooster products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.

Products

11
5.5CVE-2021-24673dwboosterappointment_hour_booking+2
EPSS score
0.62%
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.6.4CVE-2021-24712dwboosterappointment_hour_booking+2
EPSS score
0.62%
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.6.1CVE-2021-24498dwboostercalendar_event_multi_view+2
EPSS score
3.54%
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.8.8CVE-2016-20069dwboosterbooking calendar contact form
EPSS score
0.24%
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.7.2CVE-2016-20084dwboosterbooking calendar contact+1
EPSS score
0.24%
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.5.3CVE-2016-20067dwboostercp polls+1
EPSS score
0.11%
WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in.6.4CVE-2016-20070dwboosterbooking calendar contact form+1
EPSS score
0.22%
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.8.8CVE-2016-20068dwboosterbooking calendar contact form+1
EPSS score
0.30%
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.7.2CVE-2016-20066dwboostercp polls+1
EPSS score
0.19%
WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.7.2CVE-2022-2846dwboostercalendar_event_multi_view+2
EPSS score
2.70%
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.5.5CVE-2022-2169dwboosterloading_page_with_loading_screen+2
EPSS score
0.59%
The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.9.8CVE-2022-1692dwboostercp_image_store_with_slideshow+2
EPSS score
10.65%
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack4.8CVE-2022-1710dwboosterappointment_hour_booking+2
EPSS score
0.59%
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.8.8CVE-2022-41692codepeopleappointment hour booking (wordpress plugin)+2
EPSS score
0.54%
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.6.4CVE-2022-0448dwboostercp_blocks+2
EPSS score
5.73%
The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.7.8CVE-2022-4034codepeopleappointment hour booking – booking calendar+2
EPSS score
0.68%
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.7.2CVE-2022-4035codepeopleappointment hour booking – booking calendar+2
EPSS score
0.75%
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.5.3CVE-2022-4036codepeopleappointment hour booking – booking calendar+2
EPSS score
0.47%
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.8.8CVE-2022-3427codepeoplecorner ad+2
EPSS score
0.70%
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated attackers to trigger the deletion of ads via forged request granted they can trick a site administrator into performing an action such as clicking on a link.6.4CVE-2017-18579dwboostercorner_ad+1
EPSS score
0.91%
The corner-ad plugin before 1.0.8 for WordPress has XSS.