Medium severity · published May 22, 2017
CVE-2017-2168
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to…
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WB
WP Booking System · Wpbookingsystem
through 1.3.3; through 3.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2168
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2168
Third Party Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000092
Third Party Advisory
https://jvn.jp/en/jp/JVN96165722/index.html
Release Notes
https://wordpress.org/plugins/wp-booking-system/#developers
wpvulndb.com
https://wpvulndb.com/vulnerabilities/8830
More from WP Booking System
7.2
CVE-2019-12239
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access
6.1
CVE-2024-8797
WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
5.4
CVE-2021-25061
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
4.8
CVE-2023-24402
WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)