Unscored severity · published Sep 29, 2015
CVE-2015-7320
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Calendar · Codepeople
through 1.1.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7320
packetstormsecurity.com
http://packetstormsecurity.com/files/133743/WordPress-Appointment-Booking-Calendar-1.1.7-XSS.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/536556/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/536557/100/0/threaded
Patch
https://wordpress.org/plugins/appointment-booking-calendar/changelog/
wpvulndb.com
https://wpvulndb.com/vulnerabilities/8199
More from Appointment Booking Calendar
9.8
CVE-2025-46247
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This…
9.8
CVE-2016-10916
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319
8.8
CVE-2025-46241
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking…
8.8
CVE-2024-0856
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted…
8.8
CVE-2022-43482
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress