GCVE - cpe:2.3:a:renoiriii:tennis_court

Approved changes feed: RSS · Atom

cpe:2.3:a:renoiriii:tennis_court_bookings:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Renoiriii (`dff1a805-b5e0-5cbf-9eff-898a9fd0c49d`)
Product	Tennis Court Bookings (`4b3158b5-e147-5c1e-9c25-fdef846b9374`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-1044`	vulnerable	2026-06-08 07:47:14.255693	Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters MEDIUM (4.4) The Tennis Court Bookings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Published: 2026-02-19T04:36:19.648Z Updated: 2026-04-08T17:10:57.359Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/99b91fb6-9e60-447d-ab43-2be231052140?source=cve https://downloads.wordpress.org/plugin/tennis-court-bookings.zip https://wordpress.org/plugins/tennis-court-bookings/ https://plugins.trac.wordpress.org/browser/tennis-court-bookings/tags/1.2.7/views/setting.php#L65 https://plugins.trac.wordpress.org/browser/tennis-court-bookings/tags/1.2.7/views/calendar_form.php#L43	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.