Lucene search
Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site Scripting
Booking.com Banner Creator admin XSS vulnerabilit
Show more
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | WordPress Booking.com Banner Creator Plugin Cross-Site Scripting Vulnerability | 10 Nov 202100:00 | – | cnvd |
 | Cross site scripting | 8 Nov 202118:15 | – | prion |
 | WordPress Booking.com Banner Creator plugin <= 1.4.2 - Stored Cross-Site Scripting (XSS) vulnerability | 5 Oct 202100:00 | – | patchstack |
 | CVE-2021-24646 | 8 Nov 202118:15 | – | cve |
 | CVE-2021-24646 Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site Scripting | 8 Nov 202117:34 | – | cvelist |
 | CVE-2021-24646 | 8 Nov 202118:15 | – | nvd |
 | Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site Scripting | 5 Oct 202100:00 | – | wpvulndb |
* Open the plugin's add new banner page (B.com Banner -> Add New Banner)
* The form field named "Banner Copy" is vulnerable to XSS payloads like:
<--`<img/src=` onerror=alert(document.cookie)``> --!>
* Update or Publish the page, and you will be provided a shortcode similar to [bdotcom_bm bannerid="123"]
* You will then need to create a page that includes the Banner's shortcode above.
* Visiting the page with the banner's shortcode will trigger the XSS payload to execute,Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo05 Oct 2021 00:00Current
0.6Low risk
Vulners AI Score0.6
EPSS0.001