Hostel Plugin <= 1.1.3 - Unauthenticated Stored XSS



Description
This vulnerability allows any user can inject Javascript code and the code will be executed on the admin side when he visits the Bookings Page

Authentication Required:No
Affected Version: 1.1.3 or possibly below
Fixed version:1.1.4

Affects Plugin

fixed in version 1.1.4

References

CVE 2019-12345
URL https://docs.google.com/document/d/1lBnwTY82_UO9XLmoaH3mD9AF-GZ0TPQ_dNKEymDCxzY/edit?usp=sharing
URL https://plugins.trac.wordpress.org/changeset/2094560/hostel

Classification

Type XSS
OWASP Top 10 A7: Cross-Site Scripting (XSS)
CWE CWE-79

Miscellaneous

Original Researcher Admavidhya N
Submitter Admavidhya N
Views 4153
Verified No
WPVDB ID 9289

Timeline

Publicly Published 2019-05-25 (6 months ago)
Added 2019-05-27 (6 months ago)
Last Updated 2019-11-09 (5 days ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin