Extension WordPress
Vulnérabilités Appointment Hour Booking – Booking Calendar
Cette page rassemble les failles publiées pour Appointment Hour Booking – Booking Calendar, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Appointment Hour Booking – Booking Calendar
11 fiches
Appointment Hour Booking – Booking Calendar <= 1.5.60 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in all versions up to, and including, 1.5.60 due to insufficient input sanitization and output escaping on…
*-1.5.60
1.5.61
27/01/2026
Appointment Hour Booking <= 1.4.56 – Captcha Bypass
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.4.56. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.
*-1.4.56
1.4.57
22/04/2024
Appointment Hour Booking <= 1.4.23 – Missing Authorization to Double Booking
The Appointment Hour Booking plugin for WordPress is vulnerable to unauthorized double booking due to insufficient validation on the data_management() function in versions up to, and including, 1.4.23. This makes it possible for unauthenticated attackers to make double…
*-1.4.23
1.4.24
11/10/2023
Appointment Hour Booking <= 1.3.72 – CAPTCHA Bypass
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed…
*-1.3.72
1.3.73
29/11/2022
Appointment Hour Booking <= 1.3.72 – CSV Injection
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be…
*-1.3.72
1.3.73
29/11/2022
Appointment Hour Booking <= 1.3.72 – Unauthenticated iFrame Injection via Appointment Form
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame…
*-1.3.72
1.3.73
29/11/2022
Appointment Hour Booking <= 1.3.71 – Missing Authorization
The Appointment Hour Booking plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the cpapphb_feedback function in versions up to, and including, 1.3.71. This makes it possible for authenticated attackers, with subscriber-level…
*-1.3.71
1.3.72
30/10/2022
Appointment Hour Booking <= 1.3.55 – Authenticated Stored Cross-Site Scripting
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
*-1.3.55
1.3.56
23/05/2022
Appointment Hour Booking <= 1.3.16 – Cross-Site Scripting
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.
[*, 1.3.17)
1.3.17
10/09/2021
Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
[*, 1.3.16)
1.3.16
06/09/2021
Appointment Hour Booking – WordPress Booking Plugin <= 1.1.45 – Cross-Site Scripting
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
[*, 1.1.46)
1.1.46
09/07/2019
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.