WP Booking Calendar, b23fd45a3f99b282298cb10d009427a8cd1f7640

CVE, Research URL: b23fd45a3f99b282298cb10d009427a8cd1f7640
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Published on: Aug 01, 2016
Research Description: Booking Calendar [booking] < 6.2.1 Booking Calendar <= 6.2 - Cross-Site Request Forgery leading to Cross-Site Scripting The Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.2. This is due to missing or incorrect nonce validation in the plugin's Import tab. This makes it possible for unauthenticated attackers to to inject arbitrary web scripts that execute in a victim's browser via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 6.2.1.
Status: vulnerable