Booking Sms Vulnerabilities

[en] The booking-sms plugin before 1.1.0 for WordPress has XSS.

Affected:

up to 1.1.0

Fixed in:

1.1.0

Disclosed:

Aug 21, 2019

CVE-2017-18555 on NVD →

[en] The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, B...

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Dec 20, 2017

CVE-2017-17780 on NVD →

Reflected Cross-Site Scripting (XSS) vulnerability found by Elias Dimopoulos in WordPress Booking Calendar – Clockwork SMS plugin (versions <=1.0.5).

Affected:

up to 1.1.0

Fixed in:

1.1.0

Disclosed:

Dec 20, 2017

The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Bookin...

CVSS:

6.1

Affected:

up to 1.0.5

Fixed in:

1.1.1

Disclosed:

Dec 18, 2017

CVE-2017-17780 on NVD →

The Booking Calendar - Clockwork SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘to’ parameter in versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVSS:

6.1

Affected:

up to 1.0.5

Fixed in:

1.1.0

Disclosed:

Nov 27, 2017

CVE-2017-18555 on NVD →

Reflected XSS via GET parameter &quot;to&quot;. Vulnerable Plugins: ------------------------------------------ 1. Clockwork Free and Paid SMS Notifications URL: https://wordpress.org/plugins/mediaburst-email-to-sms/ Version 2.0.3 | By Clockwork 2. Two-Factor Authentication - Clockwork SMS URL: https://word...

Affected:

up to 1.1.0

Fixed in:

1.1.0