What’s Vulnerable › Vulnerabilities

CVE-2016-20070: WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-15 · updated 2026-06-17
• Weakness: CWE-79

Description

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.

Affected products

• dwbooster Booking Calendar Contact Form: through 1.0.23

References

• http://wordpress.dwbooster.com/
• https://www.exploit-db.com/exploits/39423
• https://www.vulncheck.com/advisories/wordpress-booking-calendar-contact-form-privilege-escalation-stored-xss

Get alerted when CVE-2016-20070 or the next vulnerability affects your stack