CVE-2017-2168

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WP Booking System	WP Booking System Free version	prior to version 1.4
WP Booking System	WP Booking System Premium version	prior to version 3.7

References

http://jvndb.jvn.jp/jvndb/JVNDB-2017-000092Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN96165722/index.htmlThird Party Advisory, VDB Entry
https://wordpress.org/plugins/wp-booking-system/#developersRelease Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/8830
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000092Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN96165722/index.htmlThird Party Advisory, VDB Entry
https://wordpress.org/plugins/wp-booking-system/#developersRelease Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/8830

Timeline

Published: May 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-21696.1Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to i CVE-2017-21716.1Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version CVE-2017-21726.1Cross-site scripting vulnerability in Cybozu KUNAI for Android 3.0.0 to 3.0.6 allows remote attackers to inject arbitrary web script or HTML CVE-2017-21735.4Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbi CVE-2017-21746.1Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web scri CVE-2017-21757.8Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Tr CVE-2017-21767.8Untrusted search path vulnerability in screensaver installers (jasdf_01.exe, jasdf_02.exe, jasdf_03.exe, jasdf_04.exe, jasdf_05.exe, scrambl CVE-2017-21778.8Untrusted search path vulnerability in Installer of Shogyo Touki Denshi Ninsho Software Ver 1.7 and earlier allows an attacker to gain privi CVE-2017-21788.8Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an at CVE-2017-21798.8Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, CVE-2017-21804.3Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspe CVE-2017-21818.8Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspe