CVE-2021-25040: Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting
Published Jan 3, 2022
·Updated
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected Software
1 affected component
Booking Calendar Project Booking Calendar Wordpress<8.9.2
Event History
Jan 3, 2022
CVE Published
via MITRE·12:49 PM
Data Sourced
via MITRE·12:49 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-25040?
CVE-2021-25040 has a medium severity level due to the potential for reflected cross-site scripting exploits.
2
How do I fix CVE-2021-25040?
To fix CVE-2021-25040, update the Booking Calendar plugin to version 8.9.2 or later.
3
What types of attacks are possible with CVE-2021-25040?
CVE-2021-25040 allows for reflected cross-site scripting attacks that could lead to user data theft or session hijacking.
4
What versions of the Booking Calendar plugin are affected by CVE-2021-25040?
CVE-2021-25040 affects all versions of the Booking Calendar plugin prior to 8.9.2.
5
Is CVE-2021-25040 specific to WordPress?
Yes, CVE-2021-25040 is a vulnerability specifically related to the Booking Calendar plugin for WordPress.