T
he Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is executed in the admin context.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/b3a0bb3f-50b2-4dcb-b23c-b08480363a4a/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/b3a0bb3f-50b2-4dcb-b23c-b08480363a4a/ | Exploit Third Party Advisory |
Configurations
History
14 Apr 2025, 13:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:* | |
| First Time |
Salonbookingsystem salon Booking System
Salonbookingsystem |
|
| References | () https://wpscan.com/vulnerability/b3a0bb3f-50b2-4dcb-b23c-b08480363a4a/ - Exploit, Third Party Advisory | |
| CWE | CWE-79 |
21 Nov 2024, 09:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/b3a0bb3f-50b2-4dcb-b23c-b08480363a4a/ - |
03 Jul 2024, 01:53
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.7 |
Information
Published : 2024-04-17 05:15
Updated : 2025-04-14 13:42
NVD link : CVE-2024-2101
Mitre link : CVE-2024-2101
CVE.ORG link : CVE-2024-2101
JSON object : View
Products Affected
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')