Cross site scripting

The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0389

CVE-2022-0389 affects the WP Time Slots Booking Form WordPress plugin (versions before 1.1.63). The issue arises because the plugin does not sanitise/escape calendar names, enabling stored Cross-Site Scripting (XSS) by high-privilege users, even when unfiltered_html is disallowed. Public reports ...

CVE-2022-0389: Improper Neutralization of Input During Web Page Generation

The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP Time Slots Booking Form Plugin versions prior to...

PT-2022-13148

Name of the Vulnerable Software and Affected Versions WP Time Slots Booking Form WordPress plugin versions prior to 1.1.63 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of Calendar names, even when the...

Amelia < 1.0.47 - Unauthenticated Stored XSS via lastName

The plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the /src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever...

Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure

The plugin does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it. 1. Create a booking with user01 2. Create...

WordPress Online Booking for Barbershops and Salons plugin <= 1.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Online Booking for Barbershops and Salons plugin versions = 1.0.0. Solution No patched version available...

WordPress Salon booking system plugin <= 7.6.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Salon booking system plugin versions = 7.6.1. Solution Update the WordPress Salon booking system plugin to the latest available version at least 7.6.3...

WordPress Salon booking system plugin <= 7.6.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Huli Cymetrics in WordPress Salon booking system plugin versions = 7.6.1. Solution Update the WordPress Salon booking system plugin to the latest available version at least 7.6.3...

WordPress Advanced Booking Calendar plugin <= 1.6.9 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Advanced Booking Calendar plugin versions = 1.6.9. Solution Update the WordPress Advanced Booking Calendar plugin to the latest available version at least 1.7.0...

WordPress Online Booking for Barbershops and Salons plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Online Booking for Barbershops and Salons plugin versions = 1.0.0. Solution No patched version available...

WordPress Booking Addon for WooCommerce plugin <= 4.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Booking Addon for WooCommerce plugin versions = 4.1.0. Solution Update the WordPress Booking Addon for WooCommerce plugin to the latest available version at least 4.2.0...

WordPress Webba Booking plugin < 4.2.18 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Webba Booking plugin versions 4.2.18. Solution Update the WordPress Webba Booking plugin to the latest available version at least 4.2.18...

WordPress Webba Booking plugin < 4.2.18 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Webba Booking plugin versions 4.2.18. Solution Update the WordPress Webba Booking plugin to the latest available version at least 4.2.18...

WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin <= 1.1.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin versions = 1.1.9. Solution Update the WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin to the latest available versio...

WordPress Salon Booking System Pro plugin <= 7.6.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Huli Cymetrics in WordPress Salon Booking System Pro plugin versions = 7.6.1. Solution Update the WordPress Salon Booking System Pro plugin to the latest available version at least 7.6.3...

WordPress Booking Addon for WooCommerce plugin <= 4.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Booking Addon for WooCommerce plugin versions = 4.1.0. Solution Update the WordPress Booking Addon for WooCommerce plugin to the latest available version at least 4.2.0...

WordPress Booking Weir plugin < 1.0.11 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Booking Weir plugin versions 1.0.11. Solution Update the WordPress Booking Weir plugin to the latest available version at least 1.0.11...

WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin <= 1.1.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin versions = 1.1.9. Solution Update the WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin to th...