Stored Cross-Site Scripting Vulnerability in Alex Reservations Plugin for WordPress

CVE-2024-13380

What is CVE-2024-13380?

The Alex Reservations plugin for WordPress is susceptible to stored cross-site scripting due to inadequate sanitization of user input within the 'rr_form' shortcode. Attackers with contributor-level access can exploit this vulnerability to inject malicious scripts, which will be executed when other users view the affected pages. It is crucial for site owners using this plugin to apply necessary updates and implement security measures to prevent potential exploitation.

References