CVE Database /
CVE-2024-5584
CVE · Medium
CVE-2024-5584 — Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 23.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-5584
|
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 23.3 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 23.3
|
23.3 |
2024-06-10 |
—
|
CVE-2024-5584
The Bookly plugin for WordPress contains a stored cross-site scripting vulnerability in its Color Profile parameter that affects versions 23.2 and earlier. Attackers with staff member roles or higher subscriber privileges can inject malicious scripts through inadequate input validation and output handling. When other users visit pages containing the injected code, these scripts execute in their browsers, allowing the attacker to perform actions on behalf of the victims. The vulnerability was resolved in version 23.3.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings