Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)
Description
The plugin does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
In the admin dashboard navigate to Services > Add service and put the following payload in the Price (Service Params section):
<script>alert('test')</script>
The XSS will be triggered in the Services list /wp-admin/edit.php?post_type=services
Timeline
- Publicly Published : 2021-08-10 (about 1 months ago)
- Added : 2021-08-10 (about 1 months ago)
- Last Updated : 2021-08-10 (about 1 months ago)