Vulnerabilities

TI-2023-02535 CVE-2023-2707 · GHSA-28c2-wq95-3f9j

Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS

MEDIUM 55

The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00418 Published 2023-11-27 No fix listed CWE-79

TI-2023-02533 CVE-2023-2705 · GHSA-8fh7-7jhg-rhr5

Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

MEDIUM 60

The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-09-11 Fixed in 1.10.0

Vulnerabilities

Filters

Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS

Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting