CVE-2016-20070Disclosure

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2016-20070

Full discourse1 post

CVE@CVEnew139d
Disclosure
CVE-2016-20070 WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify … https://www.cve.org/CVERecord?id=CVE-2016-20070
Post summary
CVE-2016-20070 is a privilege escalation and stored XSS vulnerability in WordPress Booking Calendar Contact Form 1.0.23, with limited details and no indication of exploitation or remediation in the provided text.
00000304
57.6K followersView on X

Explore more

Back to dashboard