CVE-2020-9371

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

• CWE-79

• http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9Exploit, Third Party Advisory
• https://wordpress.org/plugins/appointment-booking-calendar/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/10110Third Party Advisory
• https://www.hotdreamweaver.com/support/view.php?id=815925Permissions Required, Third Party Advisory
• http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9Exploit, Third Party Advisory
• https://wordpress.org/plugins/appointment-booking-calendar/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/10110Third Party Advisory
• https://www.hotdreamweaver.com/support/view.php?id=815925Permissions Required, Third Party Advisory

Published

Mar 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9365An issue was discovered in Pure-FTPd 1.0.49. An out-of-bound…7.5
• CVE-2020-9366A buffer overflow was found in the way GNU Screen before 4.8…9.8
• CVE-2020-9367The MPS Agent in Zoho ManageEngine Desktop Central MSP build…7.8
• CVE-2020-9368The Module Olea Gift On Order module through 5.0.8 for Prest…7.5
• CVE-2020-9369Sympa 6.2.38 through 6.2.52 allows remote attackers to cause…7.5
• CVE-2020-9370HUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijackin…9.1
• CVE-2020-9372The Appointment Booking Calendar plugin before 1.3.35 for Wo…7.8
• CVE-2020-9374On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command ex…9.8
• CVE-2020-9375TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209…7.5
• CVE-2020-9376D-Link DIR-610 devices allow Information Disclosure via SERV…7.5
• CVE-2020-9377D-Link DIR-610 devices allow Remote Command Execution via th…8.8
• CVE-2020-9379The Software Development Kit of the MiContact Center Busines…6.5