WordPress Plugin Vulnerabilities

Bookly #1 WordPress Booking Plugin (Lite) < 14.5 – Unauthenticated Blind Stored XSS

Description

An unauthenticated user can inject arbitrary persistent javascript code in the admin panel via Bookly plug-in.

Affects Plugins

Plugin icon
bookly-responsive-appointment-booking-tool
Fixed in 14.5

References

CVE
CVE-2018-6891
URL
https://www.gubello.me/blog/bookly-blind-stored-xss/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
Luigi
Submitter website
https://www.gubello.me/blog/
Verified
No
WPVDB ID
e3541e60-a1a1-42ba-a1fa-e79f0c751f5e

Timeline

Publicly Published
2018-02-10 (about 7 years ago)
Added
2018-02-13 (about 7 years ago)
Last Updated
2020-10-02 (about 5 years ago)

Other

Published
Title
Published
2021-09-09
Title
GNU-Mailman Integration <= 1.0.6 - Reflected Cross-Site Scripting
Published
2024-06-21
Title
Simple Video Directory < 1.4.4 - Contributor+ Stored XSS
Published
2025-03-24
Title
RainbowNews <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-05-16
Title
WP < 6.2.1 - Contributor+ Content Injection
Published
2018-05-01
Title
WF Cookie Consent <= 1.1.3 - Authenticated Persistent Cross-Site Scripting (XSS)