CVE-2021-24930 Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

2021-12-0615:55:32

CWE-79

WPScan

www.cve.org

wordpress booking

cross-site scripting

cve-2021-24930

stored xss

EPSS

0.001

Percentile

24.8%

JSON

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

CNA Affected

[
  {
    "product": "WordPress Online Booking and Scheduling Plugin – Bookly",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "20.3.1",
        "status": "affected",
        "version": "20.3.1",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/479704d8-057b-4642-b84a-4a78567ba20b

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24930