CVE-2023-1172 - CVE House
Back to Database
Status published High CVE-2023-1172

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site...

Vulnerability Description

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1172

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Vinay Kumar

References

More from ladela

View All →
CVE-2024-5584
WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Medium 6.4
CVE-2023-1159
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site...
Medium 4

Affected Vendor

Affected Software

WordPress Online Booking and Scheduling Plugin – Bookly
Vulnerable Versions:
21.5

Timeline

Official Publish: March 17th, 2023
Last Modified: January 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.