CVE-2022-1007

CVE-2022-1007: Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

Vendor Unknown

Product Advanced Booking Calendar

Weakness CWE-79 · XSS

Published April 11, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Key dates

02Disclosure timeline

April 11, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1007 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-1700 projectworlds House Rental and Property Listing sms.php cross site scripting CVE-2025-11937 Stored XSS through a system message in SecurePoll CVE-2025-62124 WordPress WP Post Signature plugin <= 0.4.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-13548 Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11435 salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting