CVE-2020-9371 in Appointment Booking Calendar Plugin
Summary
by MITRE
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/10/2025
The vulnerability identified as CVE-2020-9371 represents a critical stored cross-site scripting flaw within the Appointment Booking Calendar plugin for WordPress, affecting versions prior to 1.3.35. This security weakness resides in the cpabc_appointments.php file where the Calendar Name input field fails to properly sanitize user-supplied data before rendering it within the web application's output. The flaw allows malicious actors to inject arbitrary JavaScript or HTML code that persists in the application's database and executes whenever the affected page is accessed by other users. The vulnerability stems from inadequate input validation and output encoding mechanisms that fail to neutralize potentially dangerous characters and script tags before storing user-provided content.
From a technical perspective, this stored XSS vulnerability operates by allowing an attacker to submit malicious payloads through the Calendar Name field, which then gets stored in the database without proper sanitization. When legitimate users view the appointment calendar or related pages, their browsers execute the injected scripts within the context of their authenticated sessions. This creates a persistent threat where malicious code can perform actions such as stealing session cookies, redirecting users to phishing sites, or modifying page content. The vulnerability directly maps to CWE-79 which defines Cross-Site Scripting as a common web application security flaw occurring when untrusted data is sent to a web browser without proper validation or encoding. The ATT&CK framework categorizes this under T1059.001 for Command and Scripting Interpreter and T1566.001 for Phishing, as attackers can leverage this vulnerability to establish persistent access and deliver malicious payloads to unsuspecting users.
The operational impact of this vulnerability extends beyond simple data corruption or display issues, as it provides attackers with a persistent foothold within the WordPress environment. Once exploited, attackers can harvest user credentials, modify calendar entries, or even escalate privileges if the application lacks proper access controls. The stored nature of the vulnerability means that the malicious code remains active until manually removed from the database, creating a long-term threat vector that can affect multiple users over extended periods. Organizations using vulnerable versions of this plugin face significant risks including unauthorized access to sensitive calendar data, potential data exfiltration, and the possibility of using the compromised system as a launchpad for further attacks within the network infrastructure.
Mitigation strategies for CVE-2020-9371 primarily involve immediate patching of the Appointment Booking Calendar plugin to version 1.3.35 or later, which includes proper input sanitization and output encoding mechanisms. Administrators should also implement additional security measures such as regular security audits of installed plugins, implementing Content Security Policy headers to limit script execution, and monitoring for suspicious user activity or unauthorized modifications to calendar entries. The WordPress core team recommends verifying plugin integrity through official sources and maintaining updated security practices including regular backups, privileged access controls, and monitoring for unauthorized changes to web application components. Organizations should also consider implementing web application firewalls and input validation rules that specifically target XSS attack vectors to provide defense-in-depth against similar vulnerabilities in other components of their web infrastructure.