CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.20.
Explanation of Vulnerability in Simple Terms
Booking Ultra Pro versions up to 1.1.20 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. The vulnerability requires user interaction—typically clicking a malicious link—and can affect other users viewing the site. An attacker with admin privileges can inject code that steals session data or modifies site content for visitors.
What an attacker can do
Inject malicious scripts that execute in other users' browsers and steal session data or modify page content.
Potential impact on your site
A compromised admin account can inject scripts affecting all site visitors, risking credential theft and unauthorized modifications.
Conditions required to exploit
Attacker must have administrator privileges and the victim must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
