CVE-2024-2102

MEDIUM Year: 2024
CVSS v3 Score
4.7
Medium
Weakness Type
CWE-79
View all →

Vulnerability Description

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context.

Related Vulnerabilities

CVE-2015-8508

MEDIUM
CVSS:4.7(Medium)

Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot confi...

CWE-792015

CVE-2016-0713

MEDIUM
CVSS:4.7(Medium)

Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests.

CWE-792016

CVE-2016-2784

MEDIUM
CVSS:4.7(Medium)

CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) ...

CWE-792016

CVE-2016-7111

MEDIUM
CVSS:4.7(Medium)

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via un...

CWE-792016

CVE-2016-7650

MEDIUM
CVSS:4.7(Medium)

An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "Safari Reader" component, which allows remote attackers to con...

CWE-792016

CVE-2017-0365

MEDIUM
CVSS:4.7(Medium)

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.

CWE-792017