Availability Calendar Vulnerabilities

The Availability Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the add_availability_calendar_create_admin_page() function. This makes it possible for unauthenticated attackers to create an availa...

CVSS:

4.3

Affected:

up to 1.2.6

Fix:

No patched version reported

Disclosed:

Nov 24, 2023

CVE-2023-48744 on NVD →

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+

CVSS:

8.8

Affected:

up to 1.2.1

Fixed in:

1.2.1

Disclosed:

Aug 4, 2021

CVE-2021-24606 on NVD →

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

CVSS:

5.5

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Aug 3, 2021

CVE-2021-24604 on NVD →