BA Book Everything vulnerabilities

The WordPress plugin BA Book Everything in versions up to 1.8.33 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The BA Book Everything plugin for WordPress is vulnerable to stored XSS via the 'booking_service_qty' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

The BA Book Everything plugin for WordPress (versions up to and including 1.8.27) is vulnerable to stored cross-site scripting via the first_name parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.