CVE-2023-35048

35th percentile - higher than 35% of all known CVEs

The MagePeople Team Booking and Rental Manager for Bike plugin versions <= 1.2.1 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ authentication. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the user's browser context.

This vulnerability could lead to session data theft, admin account takeover, or other malicious actions, posing a serious threat to the application's security and user data.

It is recommended to update the plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential threats is advisable.