CVE-2020-15536

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/157116/WordPress-Hotel-Booking-System-Pro-1.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://wpvulndb.com/vulnerabilities/10171Third Party Advisory
https://packetstormsecurity.com/files/157116/WordPress-Hotel-Booking-System-Pro-1.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://wpvulndb.com/vulnerabilities/10171Third Party Advisory

Timeline

Published: Jul 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-155376.1An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI CVE-2020-155386.1XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.CVE-2020-155399.8SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.CVE-2020-15547.8A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully ex CVE-2020-155409.8We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page.CVE-2020-155419.8SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.CVE-2020-155429.8SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.CVE-2020-155439.8SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.CVE-2020-15558.8A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). CVE-2020-15567.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successf CVE-2020-155626.1An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-CVE-2020-155636.5An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 H