Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:30.457Z",
  "pubdate": "2026-09-03T17:17:30.457Z",
  "executiveSummary": "The Booking and Rental Manager plugin for WordPress, developed by Magepeople inc., is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary malicious scripts into the application's database. When a victim views the affected page, the malicious script executes within the context of the user's browser session. This flaw poses a significant security risk, as successful exploitation may result in session hijacking, unauthorized actions on behalf of the user, credential theft, or defacement of the application interface. The vulnerability affects all versions of the plugin from n/a through 2.7.7. Remediation requires an update to a secure version once available or the implementation of strict input sanitization and output encoding protocols.",
  "technicalDetails": "The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The root cause is the failure of the application to adequately sanitize or validate user-provided data before persisting it to the database or rendering it back to the browser. In the context of the Booking and Rental Manager plugin, the affected component fails to implement robust context-aware output encoding, permitting the inclusion of executable JavaScript payloads within fields that are subsequently displayed to authenticated administrators or other users.\nThe attack flow initiates when an attacker inputs a malicious payload—typically containing script tags or event handlers (e.g., <script>alert(document.cookie)</script> or onload attributes)—into vulnerable input fields within the booking or rental management interfaces. Because the plugin lacks proper neutralization, the server accepts this input as legitimate data and stores it in the back-end database.\nExploitation occurs when an unsuspecting victim, such as a site administrator or a user with elevated privileges, accesses the administrative dashboard or the front-end page where the compromised data is rendered. As the browser parses the HTML document, it encounters the injected payload and executes the script within the origin of the vulnerable application. Since the script runs in the context of the victim's session, the attacker gains the ability to bypass security constraints, steal session tokens, or perform unauthorized administrative operations.\nThe impact of this vulnerability is high, as it allows for persistent malicious activity. Since the payload is stored server-side, it is automatically re-triggered every time the infected page is accessed. There is no requirement for further interaction from the attacker once the payload is saved. The exposure is primarily network-based, requiring the attacker to have sufficient access to submit input via the plugin's interface. Given that the affected versions (n/a through 2.7.7) share this common lack of sanitization, users remain exposed until the input handling mechanisms are refactored to enforce strict allow-lists and perform context-sensitive encoding (such as converting special characters into HTML entities) before rendering user-supplied content."
}