What’s Vulnerable › Vulnerabilities

CVE-2022-1710: Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-13 · updated 2026-06-17
• Weakness: CWE-79

Description

The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

Affected products

• codepeople Appointment Hour Booking – Booking Calendar: before 1.3.56 — fixed in 1.3.56

How to fix

Upgrade to a fixed version: codepeople Appointment Hour Booking – Booking Calendar 1.3.56. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/ed162ccc-88e6-41e8-b24d-1b9f77a038b6
• https://wpscan.com/vulnerability/ed162ccc-88e6-41e8-b24d-1b9f77a038b6

Get alerted when CVE-2022-1710 or the next vulnerability affects your stack