Description
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Booking System | < 2.1.0.3 | 2.1.0.3 |
References
- https://wpscan.com/vulnerability/2a2e58bd-dc3f-4b6f-9b2d-b6d15cd2e898/ exploit vdb-entry technical-description