Advanced Booking Calendar Vulnerabilities

Update the WordPress Advanced Booking Calendar plugin to the latest available version (at least 3.2.12). An unknown person discovered and reported this SQL Injection vulnerability in WordPress Advanced Booking Calendar Plugin. This could allow a malicious actor to directly interact with your database, including but not...

Affected:

up to 3.2.12

Fixed in:

3.2.12

Disclosed:

Oct 30, 2023

[en] Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

Affected:

up to 1.7.1

Fix:

No patched version reported

Disclosed:

Dec 5, 2022

CVE-2022-45822 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

Affected:

up to 1.7.1

Fix:

No patched version reported

Disclosed:

Dec 5, 2022

CVE-2022-45824 on NVD →

The Advanced Booking Calendar for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queri...

CVSS:

9.8

Affected:

up to 1.7.1

Fix:

No patched version reported

Disclosed:

Dec 2, 2022

CVE-2022-45822 on NVD →

The Advanced Booking Calendar for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function, via forged request granted they can...

CVSS:

8.8

Affected:

up to 1.7.1

Fix:

No patched version reported

Disclosed:

Dec 1, 2022

CVE-2022-45824 on NVD →

[en] The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Apr 11, 2022

CVE-2022-1006 on NVD →

[en] The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Apr 11, 2022

CVE-2022-1007 on NVD →

The Advanced Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for admin-level attac...

CVSS:

7.2

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Mar 21, 2022

CVE-2022-1006 on NVD →

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Mar 21, 2022

CVE-2022-1007 on NVD →

[en] The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection

Affected:

up to 1.7.0

Fixed in:

1.7.0

Disclosed:

Mar 21, 2022

CVE-2022-0694 on NVD →

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection

CVSS:

9.8

Affected:

up to 1.6.9

Fixed in:

1.7.0

Disclosed:

Feb 28, 2022

CVE-2022-0694 on NVD →

[en] The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue

Affected:

up to 1.6.8

Fixed in:

1.6.8

Disclosed:

Apr 22, 2021

CVE-2021-24232 on NVD →

[en] The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

Affected:

up to 1.6.7

Fixed in:

1.6.7

Disclosed:

Apr 12, 2021

CVE-2021-24225 on NVD →

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 1.6.8

Fixed in:

1.6.8

Disclosed:

Mar 30, 2021

CVE-2021-24232 on NVD →

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

CVSS:

5.4

Affected:

up to 1.6.7

Fixed in:

1.6.7

Disclosed:

Mar 28, 2021

CVE-2021-24225 on NVD →

The Advanced Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the ‘calendarId’ parameter in versions up to, and including, 1.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta...

CVSS:

9.8

Affected:

up to 1.6.2

Fixed in:

1.6.2

Disclosed:

Oct 22, 2020

Unauthenticated SQL Injection (SQLi) vulnerability found by Lenon Leite in WordPress Advanced Booking Calendar plugin (versions <= 1.6.1).

Affected:

up to 1.6.2

Fixed in:

1.6.2

Disclosed:

Oct 22, 2020

The Advanced Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the ‘calendarId’ parameter in versions up to, and including, 1.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta...

Affected:

up to 1.6.2

Fixed in:

1.6.2

Disclosed:

Oct 22, 2020

The AJAX action abc_booking_getBookingResult, available to both authenticated and Unauthenticated users did not sanitise the calendarId parameter which was then concatenated to a SQL statement, leading an unauthenticated SQL injection issue. This could be used to retrieve information from the database, such as users&#0...

Affected:

up to 1.6.2

Fixed in:

1.6.2

No patched version is available. No reply from the vendor. minhtuanact discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Advanced Booking Calendar Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentic...

Affected:

up to 1.7.1

Fix:

No patched version reported

No patched version is available. No reply from the vendor. minhtuanact discovered and reported this SQL Injection vulnerability in WordPress Advanced Booking Calendar Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information and creating new ad...

Affected:

up to 1.7.1

Fix:

No patched version reported