CVE-2021-25040

CVE-2021-25040: Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting

Vendor Unknown
Product Booking Calendar
Weakness CWE-79 · XSS
Published January 3, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Key dates

02Disclosure timeline

January 3, 2022 CVE published
August 3, 2024 Record updated