CVE-2025-23899

WordPress Bookalet plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Jan 16, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookalet Bookalet bookalet allows Stored XSS.This issue affects Bookalet: from n/a through <= 1.0.3.

Analysis

AI-generated

Technical impact

The Bookalet WordPress plugin contains an improper neutralization of input during web page generation that allows stored cross‑site scripting (XSS). The vulnerability enables an attacker to inject malicious scripts that are persisted and subsequently rendered in the site’s output, potentially leading to session hijacking, defacement, or the execution of client‑side code in victims’ browsers. This flaw is classified as CWE‑79.

Affected Systems

The issue affects the Bookalet plugin for WordPress, versions n/a through 1.0.3. Users running any of these releases on their WordPress installations are vulnerable.

Risk and Exploitability

The severity level, as reflected by a CVSS score of 6.5, indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via user‑generated content or plugin input that is stored and later rendered without proper sanitization, allowing an attacker to inject malicious code into the site’s output.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Bookalet plugin to the latest version, which removes the stored XSS flaw.
  • If an update is not immediately available, consider removing or disabling the Bookalet plugin until a fix is released.
  • Perform a thorough review of any data that the plugin processes to ensure that it is properly sanitized, and monitor logs for suspicious input attempts.

Generated by OpenCVE AI on May 1, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3517 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BnB Select Ltd Bookalet allows Stored XSS.This issue affects Bookalet: from n/a through 1.0.3.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BnB Select Ltd Bookalet allows Stored XSS.This issue affects Bookalet: from n/a through 1.0.3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookalet Bookalet bookalet allows Stored XSS.This issue affects Bookalet: from n/a through <= 1.0.3.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BnB Select Ltd Bookalet allows Stored XSS.This issue affects Bookalet: from n/a through 1.0.3.
Title WordPress Bookalet plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 11, 2026, 10:45 PM
Reserved
Jan 16, 2025, 11:31 AM

View source JSON

Updated
Jan 17, 2025, 5:16 PM

JSON

Status
Deferred
Published
Jan 16, 2025, 9:15 PM
Modified
Jun 17, 2026, 8:57 AM

View source JSON

No data.

Updated
May 1, 2026, 8:30 PM

JSON