Headline

CVE-2022-29449: WordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress.

2 years ago

CVE

Open in Source

#xss #vulnerability #web #wordpress #auth

opal-hotel-room-booking

Software

Opal Hotel Room Booking

Vulnerable Versions

<= 1.2.7

Fixed in version

CVE

CVE-2022-29449

References

Credits

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Disclosure Date

2022-05-17

CVSS 3.0 score

Requires contributor or higher role user authentication.

Plugin does not exist, is not supported or discontinued.

Are your websites subject to this vulnerability?

Details

Stored Cross-Site Scripting (XSS) vulnerability discovered by Ngo Van Thien (Patchstack Alliance) in WordPress Opal Hotel Room Booking plugin (versions <= 1.2.7).

Solution

Deactivate and delete. No reply from the vendor.

Found a vulnerability that puts your sites at risk?

Found a vulnerability? Help us secure the web and join our community of ethical hackers.

Are you the developer of this software? Hire our researchers for a thorough security audit.