CVE-2021-25061

🗓️ 17 Jan 2022 13:00:39Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 52 Views🌐 WEB

The WP Booking System WordPress plugin before 2.0.15 is affected by reflected XSS

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-25061	17 Jan 202216:23	–	circl
CNNVD	WordPress plugin 跨站脚本漏洞	17 Jan 202200:00	–	cnnvd
CNVD	WordPress WP Booking System plugin cross-site scripting vulnerability	18 Jan 202200:00	–	cnvd
Cvelist	CVE-2021-25061 WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)	17 Jan 202213:00	–	cvelist
EUVD	EUVD-2021-11973	7 Oct 202500:30	–	euvd
NVD	CVE-2021-25061	17 Jan 202213:15	–	nvd
OSV	CVE-2021-25061	17 Jan 202213:15	–	osv
Patchstack	WordPress WP Booking System plugin <= 2.0.14 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability	10 Dec 202100:00	–	patchstack
Prion	Cross site scripting	17 Jan 202213:15	–	prion
RedhatCVE	CVE-2021-25061	22 May 202519:24	–	redhatcve

NVD

Vulners

Node

wpbookingsystem wp_booking_systemRange<2.0.15wordpress

[
  {
    "product": "WP Booking System – Booking Calendar",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.0.15",
        "status": "affected",
        "version": "2.0.15",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/2643776/wp-booking-system
wpscan	www.wpscan.com/vulnerability/bd9dc754-08a4-4bfc-8dda-3f5c0e070f7e

Parameter	Position	Path	Description	CWE
s	query param	wp-admin/admin.php?page=wpbs-calendars	Reflected XSS on wpbs-calendars admin page via s parameter	CWE-79
s	query param	wp-admin/admin.php?page=wpbs-forms	Reflected XSS on wpbs-forms admin page via s parameter	CWE-79

17 Jun 2026 03:41Current

5.4Medium risk

Vulners AI Score5.4

CVSS 23.5

CVSS 3.15.4

EPSS0.00675

CWE-79