CVE-2016-20084

Description

WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the -ict- and -ics- options or the calendar -name- parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.