CVE-2020-9371: Codepeople Appointment Booking Calendar

Medium severity, CVSS 4.8. EPSS: 3.3% chance of exploitation in the next 30 days.

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

Affected products

• Codepeople Appointment Booking Calendar: before 1.3.35 (fixed in 1.3.35)

Published 2020-03-04. Last modified 2026-06-17.