Salon Booking System Plugin Vulnerable to Stored Cross-Site Scripting Attacks
CVE-2024-2439

Currently unrated

Key Information:

Vendor

Wordpress
Status
Salon Booking System
Vendor
CVE Published:
26 April 2024

What is CVE-2024-2439?

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

References

https://wpscan.com/vulnerability/7a375077-fc70-4389-b109-...

Timeline

  • Vulnerability published

.
CVE-2024-2439 : Salon Booking System Plugin Vulnerable to Stored Cross-Site Scripting Attacks