CVE-2022-1006

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	Advanced Booking Calendar	>= 1.7.1, < 1.7.1

References

https://plugins.trac.wordpress.org/changeset/2695427Patch, Third Party Advisory
https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68Exploit, Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2695427Patch, Third Party Advisory
https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68Exploit, Patch, Third Party Advisory

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10076.1The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an CVE-2022-10087.2The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to CVE-2022-10096.1The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page wh CVE-2022-10104.8The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which c CVE-2022-10117.8A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to g CVE-2022-10128.2A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw CVE-2022-10139.8The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in CVE-2022-10149.8The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in CVE-2022-10156.6A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cau CVE-2022-10165.5A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to h CVE-2022-10185.5When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an CVE-2022-10196.1Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to