CVE-2026-107126
CVE-2026-107126 · WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
CVSS 8.8 · Alta · EPSS 0,5% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
wp booking system
- Versiones
- ≥ 0, < 2.1.0.1: Afectada (semver)
Actualiza a 2.1.0.1