CVE-2025-22684
Published: 03 February 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Stored XSS.This issue affects WP BASE Booking: from n/a through <= 5.0.0.
Security Summary
CVE-2025-22684 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the WP BASE Booking plugin (wp-base-booking-of-appointments-services-and-events) developed by Hakan Ozevin for WordPress. This issue affects all versions of the plugin from n/a through 5.0.0 inclusive. The vulnerability was published on 2025-02-03.
The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation is possible over the network by unauthenticated attackers with low attack complexity, though it requires user interaction. In a typical scenario, attackers can submit malicious input that gets stored on the server and executed in the browsers of subsequent users viewing affected pages, such as administrators or other site visitors, due to the changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-5-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)