Stored XSS in Bookero.pl WordPress Plugin

Executive Summary

The vulnerability exists in the Bookero.pl online booking system plugin for WordPress, specifically in versions up to and including 2.2. It is a Stored Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping in the bookero_products shortcode's hide_products and filter_products attributes. The raw attribute values are directly inserted into an inline <script> block without escaping, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts that execute whenever a user views the affected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute in the context of users who visit the infected pages, potentially leading to theft of user credentials, session hijacking, defacement, or distribution of malware. The impact includes loss of data integrity and confidentiality, as well as damage to the website's reputation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers with contributor-level access to inject arbitrary scripts into pages, which can lead to stored cross-site scripting (XSS) attacks. Such attacks can compromise the confidentiality and integrity of user data by executing malicious scripts in the context of other users.

This type of vulnerability can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal data against unauthorized access and modification. Stored XSS can lead to data breaches or unauthorized data exposure, potentially violating these regulations.

However, the provided information does not explicitly state the direct impact on compliance frameworks.

Useful 0 Not Useful 0