CVE-2021-24429: Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24429?
CVE-2021-24429 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting (XSS).
How do I fix CVE-2021-24429?
To fix CVE-2021-24429, update the Salon Booking System WordPress plugin to version 6.3.1 or later.
Who is affected by CVE-2021-24429?
CVE-2021-24429 affects users of the Salon Booking System WordPress plugin prior to version 6.3.1.
What type of vulnerability is CVE-2021-24429?
CVE-2021-24429 is a Stored Cross-Site Scripting (XSS) vulnerability.
What can attackers do with CVE-2021-24429?
Attackers can exploit CVE-2021-24429 to inject malicious JavaScript into the First Name field, impacting users of the system.