Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) tags or (2) search_for parameter.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rezgo | Online Booking | <= 1.8 |
Related Weaknesses (CWE)
References
- http://codevigilant.com/disclosure/wp-plugin-rezgo-online-booking-a3-cross-site-Exploit
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
- http://codevigilant.com/disclosure/wp-plugin-rezgo-online-booking-a3-cross-site-Exploit
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
FAQ
What is CVE-2014-4547?
CVE-2014-4547 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web scr...
How severe is CVE-2014-4547?
CVE-2014-4547 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-4547?
Check the references section above for vendor advisories and patch information. Affected products include: Rezgo Online Booking.