Stored Cross-Site Scripting vulnerability in Salon booking system WordPress plugin
CVE-2024-2101
Currently unrated
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 17 April 2024
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2024-2101?
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is executed in the admin context.
Affected Version(s)
Salon booking system 0 < 9.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.