Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2024-13431 (GCVE-0-2024-13431)

Vulnerability from nvd – Published: 2025-03-07 08:21 – Updated: 2026-04-08 17:33

Title

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-07 14:59 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence mitre root Scorecard

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/changeset/3246…
https://plugins.trac.wordpress.org/browser/simply…
https://plugins.trac.wordpress.org/browser/simply…
https://plugins.trac.wordpress.org/browser/simply…
https://blog.lucianohanna.com.br/security/cve/cve…

Impacted products

1 product

Vendor	Product	Version
croixhaug	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , ≤ 1.6.8.3 (semver)

Credits

Luciano Hanna

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13431",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-07T14:59:55.570458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-07T15:02:50.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "croixhaug",
          "versions": [
            {
              "lessThanOrEqual": "1.6.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Luciano Hanna"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:33:39.114Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e3e5dd-b9f1-4d24-98cc-b6ab319434e4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3246760/simply-schedule-appointments/trunk/booking-app-new/iframe-inner.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.3/booking-app-new/iframe-inner.php#L182"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.3/includes/class-styles.php#L97"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.3/includes/class-styles.php#L116"
        },
        {
          "url": "https://blog.lucianohanna.com.br/security/cve/cve-2024-13431-reflected-xss-no-simply-schedule-appointments/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-06T20:14:46.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin \u003c= 1.6.8.3 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13431",
    "datePublished": "2025-03-07T08:21:28.499Z",
    "dateReserved": "2025-01-15T19:58:02.989Z",
    "dateUpdated": "2026-04-08T17:33:39.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-7877 (GCVE-0-2024-7877)

Vulnerability from nvd – Published: 2024-11-05 06:00 – Updated: 2024-11-05 15:50

Title

Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-05 15:41 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root Scorecard

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/fbec3738-2135-45…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , < 1.6.7.55 (semver)
nsquared	appointment_booking_calendar	Affected: 0 , < 1.6.7.55 (semver) cpe:2.3:a:nsquared:appointment_booking_calendar::::::::

Credits

Jeewan Kumar Bhatta WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nsquared:appointment_booking_calendar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "appointment_booking_calendar",
            "vendor": "nsquared",
            "versions": [
              {
                "lessThan": "1.6.7.55",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T15:41:25.929217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:50:50.548Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.7.55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeewan Kumar Bhatta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T06:00:07.856Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/fbec3738-2135-458d-be25-1ffb00e6deb6/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Booking Calendar \u003c 1.6.7.55 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7877",
    "datePublished": "2024-11-05T06:00:07.856Z",
    "dateReserved": "2024-08-16T12:25:01.921Z",
    "dateUpdated": "2024-11-05T15:50:50.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7876 (GCVE-0-2024-7876)

Vulnerability from nvd – Published: 2024-11-05 06:00 – Updated: 2024-11-05 15:52

Title

Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-05 15:51 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root Scorecard

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/fffe862f-5bf0-4a…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , < 1.6.7.55 (semver)
nsquared	appointment_booking_calendar	Affected: 0 , < 1.6.7.55 (semver) cpe:2.3:a:nsquared:appointment_booking_calendar::::::::

Credits

Jeewan Kumar Bhatta WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nsquared:appointment_booking_calendar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "appointment_booking_calendar",
            "vendor": "nsquared",
            "versions": [
              {
                "lessThan": "1.6.7.55",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7876",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T15:51:25.557309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:52:12.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.7.55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeewan Kumar Bhatta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T06:00:07.461Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/fffe862f-5bf0-4a05-9d32-caff0bfdb860/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Booking Calendar \u003c 1.6.7.55 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7876",
    "datePublished": "2024-11-05T06:00:07.461Z",
    "dateReserved": "2024-08-16T12:20:01.517Z",
    "dateUpdated": "2024-11-05T15:52:12.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7129 (GCVE-0-2024-7129)

Vulnerability from nvd – Published: 2024-09-13 06:00 – Updated: 2025-09-15 19:26

Title

Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE

Summary

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-13 13:46 UTC

CWE

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Assigner

WPScan mitre root Scorecard

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/00ad9b1a-97a5-42…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , < 1.6.7.43 (semver)
nsquared	appointment_booking_calendar	Affected: 0 , < 1.6.7.43 (semver) cpe:2.3:a:nsquared:appointment_booking_calendar::::::::

Credits

Jeewan Kumar Bhatta WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nsquared:appointment_booking_calendar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "appointment_booking_calendar",
            "vendor": "nsquared",
            "versions": [
              {
                "lessThan": "1.6.7.43",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7129",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T13:46:10.172882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T19:26:20.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.7.43",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeewan Kumar Bhatta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-27T12:00:40.205Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Booking Calendar \u003c 1.6.7.43 - Admin+ Template Injection to RCE",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7129",
    "datePublished": "2024-09-13T06:00:03.731Z",
    "dateReserved": "2024-07-26T11:56:34.810Z",
    "dateUpdated": "2025-09-15T19:26:20.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-13431 (GCVE-0-2024-13431)

Vulnerability from cvelistv5 – Published: 2025-03-07 08:21 – Updated: 2026-04-08 17:33

Title

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-07 14:59 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence mitre root Scorecard

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/changeset/3246…
https://plugins.trac.wordpress.org/browser/simply…
https://plugins.trac.wordpress.org/browser/simply…
https://plugins.trac.wordpress.org/browser/simply…
https://blog.lucianohanna.com.br/security/cve/cve…

Impacted products

1 product

Vendor	Product	Version
croixhaug	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , ≤ 1.6.8.3 (semver)

Credits

Luciano Hanna

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13431",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-07T14:59:55.570458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-07T15:02:50.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "croixhaug",
          "versions": [
            {
              "lessThanOrEqual": "1.6.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Luciano Hanna"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:33:39.114Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e3e5dd-b9f1-4d24-98cc-b6ab319434e4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3246760/simply-schedule-appointments/trunk/booking-app-new/iframe-inner.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.3/booking-app-new/iframe-inner.php#L182"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.3/includes/class-styles.php#L97"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.3/includes/class-styles.php#L116"
        },
        {
          "url": "https://blog.lucianohanna.com.br/security/cve/cve-2024-13431-reflected-xss-no-simply-schedule-appointments/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-06T20:14:46.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin \u003c= 1.6.8.3 - Reflected Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13431",
    "datePublished": "2025-03-07T08:21:28.499Z",
    "dateReserved": "2025-01-15T19:58:02.989Z",
    "dateUpdated": "2026-04-08T17:33:39.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-7877 (GCVE-0-2024-7877)

Vulnerability from cvelistv5 – Published: 2024-11-05 06:00 – Updated: 2024-11-05 15:50

Title

Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-05 15:41 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root Scorecard

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/fbec3738-2135-45…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , < 1.6.7.55 (semver)
nsquared	appointment_booking_calendar	Affected: 0 , < 1.6.7.55 (semver) cpe:2.3:a:nsquared:appointment_booking_calendar::::::::

Credits

Jeewan Kumar Bhatta WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nsquared:appointment_booking_calendar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "appointment_booking_calendar",
            "vendor": "nsquared",
            "versions": [
              {
                "lessThan": "1.6.7.55",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T15:41:25.929217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:50:50.548Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.7.55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeewan Kumar Bhatta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T06:00:07.856Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/fbec3738-2135-458d-be25-1ffb00e6deb6/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Booking Calendar \u003c 1.6.7.55 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7877",
    "datePublished": "2024-11-05T06:00:07.856Z",
    "dateReserved": "2024-08-16T12:25:01.921Z",
    "dateUpdated": "2024-11-05T15:50:50.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7876 (GCVE-0-2024-7876)

Vulnerability from cvelistv5 – Published: 2024-11-05 06:00 – Updated: 2024-11-05 15:52

Title

Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-05 15:51 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root Scorecard

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/fffe862f-5bf0-4a…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , < 1.6.7.55 (semver)
nsquared	appointment_booking_calendar	Affected: 0 , < 1.6.7.55 (semver) cpe:2.3:a:nsquared:appointment_booking_calendar::::::::

Credits

Jeewan Kumar Bhatta WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nsquared:appointment_booking_calendar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "appointment_booking_calendar",
            "vendor": "nsquared",
            "versions": [
              {
                "lessThan": "1.6.7.55",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7876",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T15:51:25.557309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:52:12.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.7.55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeewan Kumar Bhatta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T06:00:07.461Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/fffe862f-5bf0-4a05-9d32-caff0bfdb860/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Booking Calendar \u003c 1.6.7.55 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7876",
    "datePublished": "2024-11-05T06:00:07.461Z",
    "dateReserved": "2024-08-16T12:20:01.517Z",
    "dateUpdated": "2024-11-05T15:52:12.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7129 (GCVE-0-2024-7129)

Vulnerability from cvelistv5 – Published: 2024-09-13 06:00 – Updated: 2025-09-15 19:26

Title

Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE

Summary

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-13 13:46 UTC

CWE

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Assigner

WPScan mitre root Scorecard

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/00ad9b1a-97a5-42…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	Affected: 0 , < 1.6.7.43 (semver)
nsquared	appointment_booking_calendar	Affected: 0 , < 1.6.7.43 (semver) cpe:2.3:a:nsquared:appointment_booking_calendar::::::::

Credits

Jeewan Kumar Bhatta WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nsquared:appointment_booking_calendar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "appointment_booking_calendar",
            "vendor": "nsquared",
            "versions": [
              {
                "lessThan": "1.6.7.43",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7129",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T13:46:10.172882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T19:26:20.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.7.43",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeewan Kumar Bhatta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-27T12:00:40.205Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Booking Calendar \u003c 1.6.7.43 - Admin+ Template Injection to RCE",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7129",
    "datePublished": "2024-09-13T06:00:03.731Z",
    "dateReserved": "2024-07-26T11:56:34.810Z",
    "dateUpdated": "2025-09-15T19:26:20.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities found for appointment_booking_calendar by nsquared

CVE-2024-13431 (GCVE-0-2024-13431)

CVE-2024-7877 (GCVE-0-2024-7877)

CVE-2024-7876 (GCVE-0-2024-7876)

CVE-2024-7129 (GCVE-0-2024-7129)

CVE-2024-13431 (GCVE-0-2024-13431)

CVE-2024-7877 (GCVE-0-2024-7877)

CVE-2024-7876 (GCVE-0-2024-7876)

CVE-2024-7129 (GCVE-0-2024-7129)