vulnerability

WordPress Plugin: bookly-responsive-appointment-booking-tool: CVE-2018-6891: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Published

Feb 10, 2018

Added

May 15, 2025

Modified

Apr 29, 2026

Description

The Online Booking and Scheduling plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 14.5. This is due to insufficient input sanitization and output escaping on the name parameter of a booking submission which makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Solution

bookly-responsive-appointment-booking-tool-plugin-cve-2018-6891

References

https://www.cve.org/CVERecord?id=CVE-2018-6891
https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3931c2-c9b4-412e-941d-840c5bb9be89?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-18636
CVE-2018-6891
https://attackerkb.com/topics/CVE-2018-6891
CWE-79
EUVD-EUVD-2018-18636

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report