Bookero.pl WordPress Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Bookero.pl online reservation system plugin for WordPress, affecting versions through 2.2. The issue arises in the 'bookero_products' shortcode, specifically through the 'hide_products' and 'filter_products' attributes. The vulnerability is caused by inadequate input sanitization and output escaping in the 'bookero_products()' function, where the raw attribute values are directly inserted into an inline script block without proper escaping. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, an authenticated user with contributor-level access or higher can use the 'bookero_products' shortcode and include unescaped script content in the 'hide_products' or 'filter_products' attributes. The injected script will execute when the page is viewed.

Remediation

Users are advised to update the Bookero.pl WordPress plugin to version 2.3 or a newer patched version.