235 matches found
CVE-2024-2102
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'smsprefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the...
CVE-2024-24717 WordPress Beds24 Online Booking Plugin <= 2.0.23 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.23...
VulnCheck KEV: CVE-2022-1952
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue...
Booking for Appointments and Events Calendar – Amelia < 1.0.86 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2023-31788 · Webbaplugins · Webba Booking
Name of the Vulnerable Software and Affected Versions: Appointment & Event Booking Calendar Plugin – Webba Booking versions 4.5.33 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking. This allows an...
CVE-2023-50851
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: from n/a before...
Sql injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: from n/a before...
CVE-2023-50851
CVE-2023-50851 affects the WordPress plugin “Appointment Booking Calendar — Simply Schedule Appointments” and is an Authenticated SQL Injection vulnerability. The issue exists in versions prior to 1.6.6.1 (reports show a patched state in 1.6.5.27; official wording indicates remediation by 1.6.6.1...
CVE-2023-5209
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...
WordPress plugin WordPress Online Booking and Scheduling Plugin Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...
PT-2023-31919 · WordPress · Wordpress Online Booking/Scheduling Plugin
Name of the Vulnerable Software and Affected Versions: WordPress Online Booking and Scheduling Plugin versions prior to 22.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...
WordPress Plugin WP Hotel Booking Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress Plugin WP Hotel Booking Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin WP Hotel Booking version...
WordPress Webba Booking Plugin < 4.5.31 is vulnerable to Cross Site Scripting (XSS)
Software Webba Booking Type Plugin Vulnerable versions 4.5.31 Fixed in 4.5.31 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Webba Plugins PSID 1c913074f660 Credits Rafie Muhammad Patchstack Required...
WordPress Plugin WP Hotel Booking 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
CVE-2022-4034
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's...
CVE-2022-4034 Appointment Hour Booking <= 1.3.72 - CSV Injection
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's...
CVE-2022-4034
The WordPress Appointment Hour Booking Plugin is affected by a CSV Injection vulnerability in versions up to and including 1.3.72. Unauthenticated attackers can embed untrusted input into booking content, which may be exported as a CSV file and opened on a vulnerable system, potentially resulting...