Wp Booking System
Monthly
Reflected cross-site scripting (CWE-79) in the WP Booking System WordPress plugin, affecting versions through 2.1.0.6, allows a remote attacker to run script in a victim's browser session by luring a logged-in WordPress user, most impactfully an administrator, to a crafted link that reflects unsanitized input into a plugin-generated page. Scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the impact is bounded by the user-interaction requirement and is best characterized as social-engineering-driven, targeted abuse rather than unattended remote compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Reflected cross-site scripting (CVSS 7.1) in WP Booking System before 2.1.0.3 allows unauthenticated remote attackers to inject script into an administrative page by luring a logged-in administrator to a crafted URL. The plugin reflects one of its parameters without validation or escaping, so the payload executes in the victim administrator's browser session and can perform actions with that user's privileges; exploitation requires user interaction (UI:R). Publicly available exploit code exists, and the vendor has released version 2.1.0.3 as a fix.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting (CWE-79) in the WP Booking System WordPress plugin, affecting versions through 2.1.0.6, allows a remote attacker to run script in a victim's browser session by luring a logged-in WordPress user, most impactfully an administrator, to a crafted link that reflects unsanitized input into a plugin-generated page. Scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the impact is bounded by the user-interaction requirement and is best characterized as social-engineering-driven, targeted abuse rather than unattended remote compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Reflected cross-site scripting (CVSS 7.1) in WP Booking System before 2.1.0.3 allows unauthenticated remote attackers to inject script into an administrative page by luring a logged-in administrator to a crafted URL. The plugin reflects one of its parameters without validation or escaping, so the payload executes in the victim administrator's browser session and can perform actions with that user's privileges; exploitation requires user interaction (UI:R). Publicly available exploit code exists, and the vendor has released version 2.1.0.3 as a fix.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.