CVE-2016-20070

Name of the Vulnerable Software and Affected Versions WordPress Booking Calendar Contact Form versions prior to 1.0.24

Description Authenticated users with subscriber-level access can perform privilege escalation and stored cross-site scripting (XSS) by exploiting insufficient input sanitization and output escaping. Attackers can inject malicious JavaScript payloads through the price, name, calendar language, and email confirmation to user parameters via the 'admin-ajax.php' and 'admin.php' endpoints. These scripts execute in the browsers of administrators, allowing the modification of plugin options.

Recommendations Update WordPress Booking Calendar Contact Form to version 1.0.24 or later.