Threats tagged 'ghsa-474f-9w4x-43hr'

The Booking Plugin for WordPress Appointments – Time Slot plugin versions up to and including 1.4.7 contains a vulnerability that allows unauthenticated attackers to send appointment notification emails to arbitrary recipients. This occurs due to missing validation on the tslot_appt_email AJAX action, enabling attackers to control certain email fields and potentially use the site for phishing or spam campaigns.