The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Fri, 27 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Wpbookingsystem
Wpbookingsystem wp Booking System
CPEs cpe:2.3:a:wpbookingsystem:wp_booking_system:*:*:*:*:*:wordpress:*:*
Vendors & Products Wpbookingsystem
Wpbookingsystem wp Booking System

Sun, 15 Sep 2024 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Sat, 14 Sep 2024 05:45:00 +0000

Type Values Removed Values Added
Description The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-09-14T05:40:42.659Z

Updated: 2024-09-15T19:57:06.184Z

Reserved: 2024-09-13T17:00:33.276Z

Link: CVE-2024-8797

cve-icon Vulnrichment

Updated: 2024-09-15T19:56:23.012Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-14T06:15:10.317

Modified: 2024-09-27T14:02:23.700

Link: CVE-2024-8797

cve-icon Redhat

No data.