CVE-2018-6891 WordPress Online Booking and Scheduling Plugin – Bookly <= 14.5 - Cross-Site Scripting
MediumCVSS 6.1
EPSS 1.00%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| booking-wp-plugin bookly | < 14.5 | 14.5 |
| wordpress bookly-responsive-appointment-booking-tool(WordPress) | < 14.6 | 14.6 |
References
- wordpress.org release-notes third-party-advisory
- www.gubello.me exploit third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org