CVE-2023-4067: XSS
First published: Wed Aug 02 2023(Updated: )
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Magepeople Bus Ticket Booking With Seat Reservation | <=5.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2945247%40bus-ticket-booking-with-seat-reservation&new=2945247%40bus-ticket-booking-with-seat-reservation&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2855cb-e4a8-4412-af24-4cee03ae2d43?source=cve
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-4067.
What is the severity of CVE-2023-4067?
The severity of CVE-2023-4067 is medium (6.1).
What is the affected software?
The affected software is the Bus Ticket Booking with Seat Reservation plugin for WordPress.
What is the cause of the vulnerability?
The vulnerability is caused by insufficient input sanitization and output escaping in the 'tab_date' and 'tab_date_r' parameters.
Are there any fixes or patches available for this vulnerability?
It is recommended to update to version 5.2.4 or later of the Bus Ticket Booking with Seat Reservation plugin for WordPress to fix this vulnerability.
- agent/references
- agent/type
- agent/remedy
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-latest
- vendor/mage-people
- canonical/magepeople bus ticket booking with seat reservation
- version/magepeople bus ticket booking with seat reservation/5.2.3