Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Booking-wp-plugin Clear all filters
TI-2023-04793 CVE-2023-5209 · GHSA-hgwf-985j-mh3j

Bookly < 22.5 - Admin+ Stored XSS

Priority LOW 22

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00451 Published 2023-11-27 Fixed in 22.5 CWE-79
TI-2023-04323 CVE-2023-4691 · GHSA-p3m2-9555-cgrw

Bookly < 22.4 - Admin+ SQLi

Priority HIGH 67

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privile…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00902 Published 2023-10-16 Fixed in 22.4
TI-2021-07209 CVE-2021-24930 · GHSA-jhv5-5gxp-jg64

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

Priority LOW 25

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2021-12-06 Fixed in 20.3.1 CWE-79