CVE-2023-1172

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

Cross site scripting

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

CVE-2023-1172

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

CVE-2023-1172

The Bookly WordPress plugin (WordPress) is affected by CVE-2023-1172, a Stored Cross‑Site Scripting (XSS) vulnerability in the full name value up to and including version 21.5, caused by insufficient input sanitization and output escaping. This could allow unauthenticated attackers to inject arbi...

CVE-2023-1172

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

WordPress Plugin Bookly 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists...

PT-2023-16798 · WordPress · Bookly

Name of the Vulnerable Software and Affected Versions: Bookly plugin for WordPress versions up to, and including, 21.5 Description: The issue is related to Stored Cross-Site Scripting via the full name value due to insufficient input sanitization and output escaping. This allows unauthenticated...

WordPress plugin Bookly 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Bookly plugin <= 20.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Mesut Cetin in WordPress Bookly plugin versions = 20.3. Solution Update the WordPress Bookly plugin to the latest available version at least 20.3.1...

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

The plugin does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue As a Staff Member, put the following payload in your Full Name Booklyn -- Profile -- Edit -- Full Name: alert/XSS/ The XSS will be triggered when an...

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

The plugin does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue PoC As a Staff Member, put the following payload in your Full Name Booklyn -- Profile -- Edit -- Full Name: The XSS will be triggered when an admin ope...

WordPress Bookly Plugin < 14.5 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:booking-wp-plugin:bookly"; if description...

WordPress Bookly Lite 13.2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications In January I found a stored XSS in Bookly WP Plugin 10,000+ download for Lite version on official WordPress plugin site and 18,000+ for Pro version on CodeCanyon. Link of Bookly stored XSS proof-of-concept:...

CVE-2018-6891

Bookly 1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-paymentdetailsdialog.js...

CVE-2018-6891

CVE-2018-6891 affects Bookly #1 WordPress Booking Plugin Lite prior to version 14.5. The issue is a cross-site scripting (XSS) vulnerability exploited through a jQuery.ajax request to ng-payment_details_dialog.js, enabling injection of arbitrary JavaScript code into the admin panel. Affected prod...

PT-2018-17806 · WordPress · Bookly

Name of the Vulnerable Software and Affected Versions: Bookly 1 WordPress Booking Plugin Lite versions prior to 14.5 Description: The issue concerns a cross-site scripting XSS flaw. It is triggered by a jQuery.ajax request to the ng-payment details dialog.js file. Recommendations: For Bookly 1...

WordPress Bookly Lite 13.2 Cross Site Scripting

In January I found a stored XSS in Bookly WP Plugin 10,000+ download for Lite version on official WordPress plugin site and 18,000+ for Pro version on CodeCanyon. Link of Bookly stored XSS proof-of-concept: https://www.gubello.me/blog/bookly-blind-stored-xss/ During the booking phase, an...

Bookly #1 WordPress Booking Plugin (Lite) <= 13.2 – Unauthenticated Blind Stored XSS

An unauthenticated user can inject arbitrary persistent javascript code in the admin panel via Bookly plug-in...

WordPress Bookly plugin <= 14.4 - Unauth. Stored Cross-Site Scripting (XSS) vulnerability

Unauth. Stored Cross-Site Scripting XSS vulnerability discovered by Luigi in the WordPress Bookly plugin versions = 14.4. Solution Update the WordPress Bookly plugin to the latest available version at least 14.5...