Medium severity · published Nov 29, 2022
CVE-2022-4035
Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AH
Appointment Hour Booking – Booking Calendar · codepeople
through 1.3.72 · source: vendor
AH
Appointment Hour Booking · Dwbooster
through 1.3.72 · source: NVD
Affected product
AH
Appointment Hour Booking – Booking Calendar
codepeople
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4035
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/870ae326-a7c9-4201-bf0d-0fbda663a694?source=cve
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4035
More from Appointment Hour Booking – Booking Calendar
7.8
CVE-2022-4034
Appointment Hour Booking <= 1.3.72 - CSV Injection
7.2
CVE-2026-96573
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
5.3
CVE-2022-4036
Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
4.4
CVE-2026-1083
Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration