Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)

less than 1 minute read

Description

The plugin does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

In the admin dashboard navigate to Services > Add service and put the following payload in the Price (Service Params section):

<script>alert('test')</script>

The XSS will be triggered in the Services list /wp-admin/edit.php?post_type=services

Timeline

  • Publicly Published : 2021-08-10 (about 1 months ago)
  • Added : 2021-08-10 (about 1 months ago)
  • Last Updated : 2021-08-10 (about 1 months ago)

Links

Tags:

Categories:

Updated: