medium4.8Public exploit code
CVE-2024-9458
The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)2025-04-06 · webapps · php
Impact
The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Reservit | Reservit Hotel | Version 2.1 |