Amelia Plugin Stored XSS Vulnerability (CVE-2022-29356) Advisory

The user requests a summary of key vulnerability information from a webpage screenshot, including vulnerability overview, affected scope, remediation plan, and extraction of POC code. 1. Vulnerability Overview: Title: Vulnerability Details for Booking for Appointments and Events Calendar – Amelia Vulnerability Name: Stored Cross-Site Scripting (XSS) Description: The plugin in Amelia contains a stored XSS vulnerability. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code in the victim's browser by submitting malicious scripts to the plugin's form. CVSS Score: 6.5 (Medium) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Publication Date: 2022-06-06 Remediation Date: 2022-06-06 2. Affected Scope: Software Name: Amelia (Booking for Appointments and Events Calendar) Software Type: Plugin Affected Versions: = 1.18 Related CVE: CVE-2022-29356 3. Remediation: Recommendation: Upgrade to version 1.18 or higher. Specific Action: An "Upgrade Now" button is provided at the bottom of the page, linking to the Wordfence upgrade page. 4. POC/Exploit Code: The page does not provide specific POC code or exploit code blocks. It only describes the vulnerability type (Stored XSS) and the affected functionality (form submission), without providing specific payloads or code snippets. 5. Historical Vulnerabilities: The page lists historical vulnerabilities for this plugin, including: Stored Cross-Site Scripting (XSS) - CVE-2022-29356 (currently discussed) Stored Cross-Site Scripting (XSS) - CVE-2021-39356 Stored Cross-Site Scripting (XSS) - CVE-2021-39355 Stored Cross-Site Scripting (XSS) - CVE-2021-39354 Stored Cross-Site Scripting (XSS) - CVE-2021-39353 Stored Cross-Site Scripting (XSS) - CVE-2021-39352 Stored Cross-Site Scripting (XSS) - CVE-2021-39351 Stored Cross-Site Scripting (XSS) - CVE-2021-39350 Stored Cross-Site Scripting (XSS) - CVE-2021-39349 Stored Cross-Site Scripting (XSS) - CVE-2021-39348 Stored Cross-Site Scripting (XSS) - CVE-2021-39347 Stored Cross-Site Scripting (XSS) - CVE-2021-39346 Stored Cross-Site Scripting (XSS) - CVE-2021-39345 Stored Cross-Site Scripting (XSS) - CVE-2021-39344 Stored Cross-Site Scripting (XSS) - CVE-2021-39343 Stored Cross-Site Scripting (XSS) - CVE-2021-39342 Stored Cross-Site Scripting (XSS) - CVE-2021-39341 Stored Cross-Site Scripting (XSS) - CVE-2021-39340 Stored Cross-Site Scripting (XSS) - CVE-2021-39339 Stored Cross-Site Scripting (XSS) - CVE-2021-39338 Stored Cross-Site Scripting (XSS) - CVE-2021-39337 Stored Cross-Site Scripting (XSS) - CVE-2021-39336 Stored Cross-Site Scripting (XSS) - CVE-2021-39335 Stored Cross-Site Scripting (XSS) - CVE-2021-39334 Stored Cross-Site Scripting (XSS) - CVE-2021-39333 Stored Cross-Site Scripting (XSS) - CVE-2021-39332 Stored Cross-Site Scripting (XSS) - CVE-2021-39331 Stored Cross-Site Scripting (XSS) - CVE-2021-39330 Stored Cross-Site Scripting (XSS) - CVE-2021-39329 Stored Cross-Site Scripting (XSS) - CVE-2021-39328 Stored Cross-Site Scripting (XSS) - CVE-2021-39327 Stored Cross-Site Scripting (XSS) - CVE-2021-39326 Stored Cross-Site Scripting (XSS) - CVE-2021-39325 Stored Cross-Site Scripting (XSS) - CVE-2021-39324 Stored Cross-Site Scripting (XSS) - CVE-2021-39323 Stored Cross-Site Scripting (XSS) - CVE-2021-39322 Stored Cross-Site Scripting (XSS) - CVE-2021-39321 Stored Cross-Site Scripting (XSS) - CVE-2021-39320 Stored Cross-Site Scripting (XSS) - CVE-2021-39319 Stored Cross-Site Scripting (XSS) - CVE-2021-39318 Stored Cross-Site Scripting (XSS) - CVE-2021-39317 Stored Cross-Site Scripting (XSS) - CVE-2021-39316 Stored Cross-Site Scripting (XSS) - CVE-2021-39315 Stored Cross-Site Scripting (XSS) - CVE-2021-39314 Stored Cross-Site Scripting (XSS) - CVE-2021-39313 Stored Cross-Site Scripting (XSS) - CVE-2021-39312 Stored Cross-Site Scripting (XSS) - CVE-2021-39311 Stored Cross-Site Scripting (XSS) - CVE-2021-39310 Stored Cross-Site Scripting (XSS) - CVE-2021-39309 Stored Cross-Site Scripting (XSS) - CVE-2021-39308 Stored Cross-Site Scripting (XSS) - CVE-2021-39307 Stored Cross-Site Scripting (XSS) - CVE-2021-39306 Stored Cross-Site Scripting (XSS) - CVE-2021-39305 Stored Cross-Site Scripting (XSS) - CVE-2021-39304 Stored Cross-Site Scripting (XSS) - CVE-2021-39303 Stored Cross-Site Scripting (XSS) - CVE-2021-39302 Stored Cross-Site Scripting (XSS) - CVE-2021-39301 Stored Cross-Site Scripting (XSS) - CVE-2021-39300 Stored Cross-Site Scripting (XSS) - CVE-2021-39299 Stored Cross-Site Scripting (XSS) - CVE-2021-39298 Stored Cross-Site Scripting (XSS) - CVE-2021-39297 Stored Cross-Site Scripting (XSS) - CVE-2021-39296 Stored Cross-Site Scripting (XSS) - CVE-2021-39295 Stored Cross-Site Scripting (XSS) - CVE-2021-39294 Stored Cross-Site Scripting (XSS) - CVE-2021-39293 Stored Cross-Site Scripting (XSS) - CVE-2021-39292 Stored Cross-Site Scripting (XSS) - CVE-2021-39291 Stored Cross-Site Scripting (XSS) - CVE-2021-39290 Stored Cross-Site Scripting (XSS) - CVE-2021-39289 Stored Cross-Site Scripting (X

Goal Reached Thanks to every supporter — we hit 100%!

Amelia Plugin Stored XSS Vulnerability (CVE-2022-29356) Advisory

More from this source