CVE-2021-24930

State: PUBLISHED · Published: 2021-12-06 · Updated: 2024-08-03 · Assigner: WPScan

Description

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

CWE

CWE-79 — CWE-79 Cross-site Scripting (XSS)

Affected

Unknown / WordPress Online Booking and Scheduling Plugin – Bookly — v=20.3.1 <20.3.1 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/479704d8-057b-4642-b84a-4a78567ba20b x_refsource_MISC

Source

cvelistV5-main/cves/2021/24xxx/CVE-2021-24930.json