CVE-2016-20084: dwbooster booking calendar contact Cross-site Scripting
Vulnerability summary
CVE-2016-20084 is a high (CVSS 7.2) Cross-site Scripting vulnerability in dwbooster booking calendar contact. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.1.25.
Timeline
- 15-06-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.
CVSS metrics
5 scores · 3 sources · 2 versions- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- wordfenceSource7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
0.00 pp
From 0.24% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundWordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dwbooster1 product
- booking calendar contact≤ 1.1.24
Wordpress1 product
- booking-calendar-contact-form≤ 1.1.24 (fixed in 1.1.25)
2 vendors · 2 products