WordPress Plugin Vulnerabilities

Beds24 Online Booking < 2.0.25 - Contributor+ Stored XSS

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
beds24-online-booking
Fixed in 2.0.25

References

CVE
CVE-2023-52228
URL
https://patchstack.com/database/vulnerability/beds24-online-booking/wordpress-beds24-online-booking-plugin-2-0-23-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ngô Thiên An (ancorn_)
Verified
No
WPVDB ID
0d0825fa-0ecf-4cc4-b05e-22ef58488d9d

Timeline

Publicly Published
2024-01-08 (about 2 years ago)
Added
2024-01-15 (about 2 years ago)
Last Updated
2024-10-18 (about 1 year ago)

Other

Published
Title
Published
2023-08-22
Title
Landing Page Builder < 1.5.1.3 - Admin+ Stored XSS
Published
2015-04-01
Title
Favicon by RealFaviconGenerator <= 1.2.12 - Cross-Site Scripting (XSS)
Published
2014-08-01
Title
WooCommerce Predictive Search - index.php rs Parameter XSS
Published
2025-04-02
Title
User Submitted Posts < 20250327 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-06-18
Title
MaxGalleria < 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode