CVE-2016-20070

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.

Score

CVSS 3.1 6.4 Medium

Status

Deferred - disclosure@vulncheck.com

Published

2026-06-15

Last modified

2026-07-15

Weaknesses

CWE-79

Affected products

• Booking Calendar Contact Form (Codepeople)

References

• http://wordpress.dwbooster.com/
• https://www.exploit-db.com/exploits/39423
• https://www.vulncheck.com/advisories/wordpress-booking-calendar-contact-form-privilege-escalation-stored-xss