CVE-2022-4035

Name of the Vulnerable Software and Affected Versions Appointment Hour Booking plugin for WordPress versions up to, and including, 1.3.72

Description The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject iFrame tags via the email or general field parameters. This enables attackers to inject iFrames when submitting a booking, which will execute whenever a user accesses the injected booking details page.

Recommendations For versions up to, and including, 1.3.72, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent iFrame injection attacks. As a temporary workaround, consider restricting access to the booking details page or disabling the submission of bookings until a patch is available. Avoid using the email and general field parameters in the affected plugin until the issue is resolved.