Hostel Plugin <= 1.1.3 - Unauthenticated Stored XSS



Description
This vulnerability allows any user can inject Javascript code and the code will be executed on the admin side when he visits the Bookings Page

Authentication Required:No
Affected Version: 1.1.3 or possibly below
Fixed version:1.1.4

Affects Plugin

fixed in version 1.1.4

References

CVE 2019-12345
URL https://docs.google.com/document/d/1lBnwTY82_UO9XLmoaH3mD9AF-GZ0TPQ_dNKEymDCxzY/edit?usp=sharing
URL https://plugins.trac.wordpress.org/changeset/2094560/hostel

Classification

Type XSS
OWASP Top 10 A3: Cross-Site Scripting (XSS)
CWE CWE-79

Miscellaneous

Original Researcher Admavidhya N
Submitter Admavidhya N
Views 2098
Verified No
WPVDB ID 9289

Timeline

Publicly Published 2019-05-25 (26 days ago)
Added 2019-05-27 (23 days ago)
Last Updated 2019-05-29 (21 days ago)

Copyright & License

Copyright All data and resources contained within this page and this web site is Copyright © The WPScan Team.
License Some of this data may be used for non-commercial purposes, however, any potential commercial usage of this data will require a license. If you would like to inquire about a commercial license please contact us.