Booking Calendar Contact Form
Approved changes feed: RSS · Atom
cpe:2.3:a:dwbooster:booking_calendar_contact_form:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Dwbooster (68f45f7b-4028-5f7d-8f51-d831b376be86) |
|---|---|
| Product | Booking Calendar Contact Form (a5d2bf34-9c89-531b-9e61-c2585fa0223a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2016-20070 |
vulnerable | 2026-07-28 18:32:21.534082 |
WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS
MEDIUM (6.4)
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.
Published: 2026-06-15T12:00:40.261Z
Updated: 2026-07-15T01:23:20.724Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-20069 |
vulnerable | 2026-07-28 18:32:21.533939 |
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
HIGH (8.2)
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.
Published: 2026-06-15T12:00:39.584Z
Updated: 2026-07-15T01:23:20.044Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-20068 |
vulnerable | 2026-07-28 18:32:21.533716 |
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
HIGH (8.2)
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.
Published: 2026-06-15T12:02:21.342Z
Updated: 2026-07-15T01:23:19.343Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.