Easybook Vulnerabilities

[en] The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Jan 13, 2020

CVE-2019-20209 on NVD →

[en] The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Jan 13, 2020

CVE-2019-20210 on NVD →

[en] The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Websi...

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Jan 13, 2020

CVE-2019-20211 on NVD →

[en] The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Jan 13, 2020

CVE-2019-20212 on NVD →

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.

CVSS:

7.2

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Dec 27, 2019

CVE-2019-20212 on NVD →

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.

CVSS:

7.2

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Dec 27, 2019

CVE-2019-20211 on NVD →

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow unspecified authenticated users to delete any page/post/listing via insecure Direct Object Reference (IDOR).

CVSS:

6.5

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Dec 27, 2019

CVE-2019-20209 on NVD →

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.

CVSS:

6.1

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Dec 27, 2019

CVE-2019-20210 on NVD →