Lucene search
WPScanCVELIST:CVE-2023-5209HistoryNov 27, 2023 - 4:21 p.m.
CVE-2023-5209 Bookly < 22.5 - Admin+ Stored XSS
2023-11-2716:21:59
WPScan
www.cve.org
3
wordpress
online booking
scheduling
plugin
cve-2023-5209
stored xss
vulnerability
cross-site scripting
admin
settings
unfiltered_html
multisite
EPSS
0
Percentile
14.0%
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CNA Affected
[
{
"vendor": "Unknown",
"product": "WordPress Online Booking and Scheduling Plugin",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "22.5"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
wpvulndb
wpvulndb
Bookly < 22.5 - Admin+ Stored XSS
2023-11-06 00:00:00
nvd
nvd
CVE-2023-5209
2023-11-27 17:15:08
cve
cve
CVE-2023-5209
2023-11-27 17:15:08
prion
prion
Cross site scripting
2023-11-27 17:15:00
wpexploit
wpexploit
Bookly < 22.5 - Admin+ Stored XSS
2023-11-06 00:00:00