Dashboard / CVE-2016-20084

CVE-2016-20084

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 50/100
Published: 2026-06-15 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
AT: None
VC: None
VI: None
VA: None

Description

WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
dwbooster Appointment Booking Calendar 0
dwbooster Appointment Booking Calendar 0

References & Advisories (3)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002450
Percentile 15.7%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links