CVE-2021-24930: Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-06 · updated 2026-06-17
Weakness: CWE-79

Description

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

Affected products

ladela WordPress Online Booking and Scheduling Plugin – Bookly: before 20.3.1 — fixed in 20.3.1

How to fix

Upgrade to a fixed version: ladela WordPress Online Booking and Scheduling Plugin – Bookly 20.3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/479704d8-057b-4642-b84a-4a78567ba20b
https://wpscan.com/vulnerability/479704d8-057b-4642-b84a-4a78567ba20b

Get alerted when CVE-2021-24930 or the next vulnerability affects your stack