Is CVE-2016-20084 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-20084 being exploited in the wild.

How severe is CVE-2016-20084?

High severity, with a CVSS score of 7.2, published 15 June 2026.

Which products and versions are affected?

CodePeople Appointment Booking Calendar <= 1.1.24.

Is there a fix for CVE-2016-20084?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-20084 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-20084?

Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20084: CodePeople Appointment Booking Calendar privilege escalation and XSS

Q: Is there a fix for CVE-2016-20084?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2016-20084 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2016-20084?

Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20084 · Severity: high · CVSS 7.2 · Published 2026-06-15

The Appointment Booking Calendar plugin for WordPress, used for managing online reservations and PayPal payments, contains security flaws that allow unauthorized individuals to change calendar settings. Attackers can also plant malicious scripts that run when a site administrator or visitor views the calendar. This could lead to unauthorized access to the website's management interface or the theft of sensitive user information.

Technologies: CodePeople Appointment Booking Calendar. Vendors: CodePeople.

Quick answers

Is CVE-2016-20084 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-20084 being exploited in the wild.
How severe is CVE-2016-20084?: High severity, with a CVSS score of 7.2, published 15 June 2026.
Which products and versions are affected?: CodePeople Appointment Booking Calendar <= 1.1.24.
Is there a fix for CVE-2016-20084?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-20084 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-20084?: Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Appointment Booking Calendar plugin (also known as Booking Calendar Contact Form) for WordPress is vulnerable to privilege escalation and stored Cross-Site Scripting (XSS) due to insufficient access controls and input sanitization in the 'admin.php' page. Unauthenticated attackers can send crafted GET requests to modify plugin options such as 'ict', 'ics', and the calendar 'name' parameter. This allows for the injection of persistent JavaScript payloads that execute in the context of an administrative user's session or a site visitor's browser. The vulnerability stems from the plugin failing to verify administrative privileges before processing configuration updates.

Affected products

CodePeople Appointment Booking Calendar (Booking Calendar Contact Form) <= 1.1.24

Timeline

2016-01-08: other: Vulnerability discovered
2016-01-24: other: Reported to vendor
2016-01-27: disclosed: Public exploit released on Exploit-DB
2026-06-15: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.