CVE-2024-2439: Salon booking system <= 9.6.5 - Editor+ Stored XSS
Published Apr 26, 2024
·Updated
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
2 affected components
WordPress Salon booking system<=9.6.5
Salonbookingsystem Salon Booking System Wordpress<9.6.6
Event History
Apr 26, 2024
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
DescriptionWeakness
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-2439?
CVE-2024-2439 has a medium severity rating due to its potential for Stored Cross-Site Scripting attacks by high privilege users.
2
How do I fix CVE-2024-2439?
To fix CVE-2024-2439, update the Salon Booking System plugin to version 9.6.6 or later.
3
Who is affected by CVE-2024-2439?
CVE-2024-2439 affects users of the Salon Booking System WordPress plugin version up to 9.6.5.
4
What type of vulnerability is CVE-2024-2439?
CVE-2024-2439 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
Can unprivileged users exploit CVE-2024-2439?
No, CVE-2024-2439 can be exploited only by high privilege users such as Editors.