WordPress Online Booking and Scheduling Plugin – Bookly, CVE-2023-1172

CVE, Research URL: CVE-2023-1172
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Published on: Mar 17, 2023
Research Description: The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 21.6.
Status: vulnerable