CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
Explanation of Vulnerability in Simple Terms
Booking Calendar Contact Form versions up to 1.2.55 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. An admin must visit a specially crafted page or link to trigger the vulnerability. The injected script executes in other users' browsers, potentially compromising site security and user data.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they visit the site.
Potential impact on your site
A compromised admin account can inject scripts affecting all site visitors, risking credential theft and malware distribution.
Conditions required to exploit
Attacker must have administrator privileges and trick a user into visiting a malicious link or page.
Key dates
External resources
Related vulnerabilities
