CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a through <= 1.2.16.
Explanation of Vulnerability in Simple Terms
VikAppointments Services Booking Calendar versions 1.2.16 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they interact with the booking calendar. The vulnerability requires user interaction and can affect multiple users across the site. Upgrade to a version newer than 1.2.16 to remediate.
What an attacker can do
Inject malicious scripts that run in visitors' browsers, stealing session tokens or redirecting users to phishing sites.
Potential impact on your site
Visitors' sessions and credentials at risk; site reputation damage if used for phishing or malware distribution.
Conditions required to exploit
Visitor must click a malicious link or visit a page containing the injected payload; no authentication required.
Key dates
External resources
Related vulnerabilities
