Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

**Welcome to Hotel Booking WP plugin**

This plugin is an useful system to manage all your booking.

1.  Install and activate the plugin.

This plugin works fine as he promised, but have the worst html I've ever seen. All classes have a generic name, css customizations are impossible.

Sorry to say but html outputs from this plugin have the worst code quality I've ever seen. Everything have same class, no way to select specific element to apply custom css. If they want to apply 10px height, they have a class for that. Background white, another class for that and bla bla bla. This is the way this plugin shows button: <a style="border:2px solid #78635a; color:#78635a;" href=".." class="nd\_booking\_padding\_15\_30\_important nd\_options\_second\_font\_important nd\_booking\_border\_radius\_0\_important nd\_booking\_background\_color\_transparent\_important nd\_booking\_cursor\_pointer nd\_booking\_display\_inline\_block nd\_booking\_font\_size\_11 nd\_booking\_font\_weight\_bold nd\_booking\_letter\_spacing\_2" target="\_self">BOOK NOW FROM 25 $</a> Every element have same classes but not a single unique class to identify what the element is. This makes it impossible to customize elements

Excellent, but missing possibility to set up accommodation for children. For example: Room for two adults + one child (free).

a good plugin with great potential

Easy to use plugin, very good / luxury looking , you can see it there \[ link redacted \] Unfortunately it doesn't suit my particular needs so i had to uninstall it. Thank for your job.

Read all 6 reviews

“Hotel Booking” is open source software. The following people have contributed to this plugin.

Contributors

*    nicdark

**3.3**

*   improved sanitation on POST requests

**3.2**

*   Improved plugin security ( added realpath(), Data Sanitization/Escaping variables )
*   Added wpdb::prepare() function on db query

**3.1**

*   added layout 2 on room post grid ( elementor )
*   added images size option on room post grid ( elementor )
*   fixed math.round night number in single room
*   fixed maj text on calendar

**3.0**

*   elementor compatibility 3.6

**2.9**

*   added order elementor component
*   added steps elementor component
*   added static shortcode room
*   added static shortcode branch

**2.8**

*   added 3rd color in plugin colors
*   added themes label in admin plugin options
*   created mtbs woo on integration room options for link the room to woo product
*   added nd\_booking\_qnt\_room\_bookable() function for add availability alert on search page room preview
*   added mandatory additional service ( example : cleaning fee )
*   added elementor search and rooms post grid component
*   added ical download reservations

**2.7**

*   added alert messages addons
*   added info price icon addons on room preview in the search page
*   added branch selector addons in the search page

**2.6**

*   updated metabox function for save all datas in db ( deleted all empty meta datas )
*   changed exceptions date format
*   changed single room layout

**2.5**

*   added nonce on ajax calls

**2.4.2**

*   sanitize POST and REQUEST calls
*   added wp\_remote\_get() function for external requests ( stripe,paypal )

**2.4.1**

*   sanitize, validate, and escape all datas on POST and GET requests
*   improved plugins\_url()
*   added nonce on ajax calls
*   removed import/export feature

**2.4**

*   added some IDs on elements

**2.3.9**

*   added compatibility with latest wp version

**2.3.8**

*   added the possibility to change the slug for custom post type 1
*   improved the export option feature

**2.3.7**

*   changed some 404 static link

**2.3.6**

*   fixed post\_id null variable on paypal payment

**2.3.5**

*   add new layout 5 on rooms component
*   add new layout 2 on search component
*   added new classes on style.css
*   implemented ajax services filter on search results shortcode
*   updated .pot file

**2.3.4**

*   added the possibility to blog the reservation on certain days
*   added minimum booking days option

**2.3.3**

*   updated languages .pot file
*   added Stripe payment methods addon
*   added VAT and City TAX management
*   added the possibility to add orders via admin panel

**2.3.2**

*   updated languages .pot file
*   added the possibility to link translated room with its default room when using WPML
*   fixed date format when user book a room in the current day

**2.3.1**

*   fixed special characters in order notification emails
*   added wp\_mail() function to send email notifications

**2.3.0**

*   show all rooms in calendar view dashboard feature
*   added new translations strings on email template
*   added new translations strings on thank you and order page
*   fixed week price problem on single room page
*   extended the custom link feature for single room page

**2.2.9**

*   direct booking access from the single room page

**2.2.8**

*   updated .pot language file
*   updated date picker language with date\_i18n function
*   added register and login alert on booking step

**2.2.7**

*   added calendar view for better orders management

**2.2.6**

*   added coupon management
*   added price guests options on plugin settings

**2.2.5**

*   added new quantity options on room settings metabox

**2.2.4**

*   added the possibility to set in plugin settings the price range values on the search archive page.

**2.2.3**

*   added translations for date picker
*   added action parameter on search visual composer component for WPML integration
*   updated nd-booking.pot file with new translations

**2.2.2**

*   added email notification templates
*   solved integer night number on search shortcode

**2.2.1**

*   update nd\_booking\_get\_room\_link() function

**2.2**

*   improve external booking integration implementation

**2.1**

*   added layout-2 for steps and orders components ( for better color management )
*   added ID in some elements
*   added some new css rules

**2.0**

*   create new cpt
*   create new metabox

**1.0**

*   Initial version

CVE-2022-29443: Hotel Booking

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.



Expand Up @@ -8,7 +8,7 @@ \*/  
/\* \* Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de) \* Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de) \* \* This program is free software; you can redistribute it and/or modify \* it under the terms of the GNU General Public License as published by Expand Down Expand Up @@ -71,6 +71,8 @@ function return\_function($output) { \*/ function ame\_ajax\_save\_mediadesc() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['postid'\] ); $new\_mediadesc = $\_POST\['new\_mediadesc'\];  
Expand All @@ -96,6 +98,8 @@ function ame\_ajax\_save\_mediadesc() { \*/ function ame\_ajax\_set\_commentstatus() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['postid'\] ); $q\_status = intval( $\_POST\['comment\_status'\] );  
Expand Down Expand Up @@ -127,6 +131,7 @@ function ame\_ajax\_set\_commentstatus() { \*/ function ame\_get\_pageorder() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
if( !current\_user\_can( 'edit\_pages' ) ) { die(); Expand Down Expand Up @@ -155,6 +160,8 @@ function ame\_get\_pageorder() { \*/ function ame\_ajax\_save\_tags() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['postid'\] ); $ame\_tags = $\_POST\['new\_tags'\];  
Expand Down Expand Up @@ -200,6 +207,8 @@ function ame\_ajax\_save\_tags() { \*/ function ame\_ajax\_get\_categories() { global $wpdb, $post; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$ame\_id = intval( $\_POST\['postid'\] );  
if( !current\_user\_can( 'edit\_post', $ame\_id ) ) { Expand Down Expand Up @@ -232,6 +241,8 @@ function ame\_ajax\_get\_categories() { \*/ function ame\_ajax\_save\_categories() { global $wpdb, $post; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['postid'\] ); $ame\_cats = $\_POST\['ame\_cats'\];  
Expand Down Expand Up @@ -272,6 +283,8 @@ function ame\_ajax\_save\_categories() { \*/ function ame\_toggle\_showinvisposts() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$status = intval( $\_POST\['status'\] );  
update\_option( "ame\_toggle\_showinvisposts", $status ); Expand Down Expand Up @@ -300,6 +313,8 @@ function ame\_ajax\_toggle\_imageset() { \*/ function ame\_toggle\_orderoptions() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$status = intval( $\_POST\['status'\] );  
update\_option( "ame\_show\_orderoptions", $status ); Expand All @@ -314,6 +329,8 @@ function ame\_toggle\_orderoptions() { \*/ function ame\_slug\_edit() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['category\_id'\] ); if( is\_string( $\_POST\['posttype'\] ) ) $posttype = $\_POST\['posttype'\];  
Expand Down Expand Up @@ -342,6 +359,8 @@ function ame\_slug\_edit() { \*/ function ame\_author\_edit() { global $wpdb, $current\_user; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['post\_id'\] );  
if( !current\_user\_can( 'edit\_post', $postid ) ) { Expand Down Expand Up @@ -396,6 +415,8 @@ function ame\_author\_edit() { \*/ function ame\_save\_order() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['category\_id'\] ); $neworderid = intval( $\_POST\['new\_orderid'\] );  
Expand All @@ -416,6 +437,8 @@ function ame\_save\_order() { \*/ function ame\_save\_slug() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['category\_id'\] );  
if( !current\_user\_can( 'edit\_post', $postid ) ) { Expand Down Expand Up @@ -451,6 +474,8 @@ function ame\_save\_slug() { \*/ function ame\_save\_author() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['category\_id'\] );  
if( !current\_user\_can( 'edit\_post', $postid ) ) { Expand Down Expand Up @@ -480,6 +505,8 @@ function ame\_save\_author() { \*/ function ame\_save\_title() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['category\_id'\] ); $new\_title = $\_POST\['new\_title'\]; $new\_title = apply\_filters( 'the\_title', $new\_title ); Expand All @@ -504,6 +531,8 @@ function ame\_save\_title() { \*/ function ame\_set\_date() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( substr( $\_POST\['category\_id'\], 10, 5 ) );  
if( !current\_user\_can( 'edit\_post', $postid ) ) { Expand Down Expand Up @@ -542,6 +571,8 @@ function ame\_set\_date() { \*/ function ame\_toggle\_visibility() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['category\_id'\] );  
if( !current\_user\_can( 'edit\_post', $postid ) ) { Expand Down Expand Up @@ -584,6 +615,8 @@ function ame\_toggle\_visibility() { \*/ function ame\_toggle\_sticky() { global $wpdb; check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
$postid = intval( $\_POST\['post\_id'\] );  
if( !current\_user\_can( 'edit\_post', $postid ) ) { Expand Down Expand Up @@ -612,6 +645,8 @@ function ame\_toggle\_sticky() { \* @link http://plugins.trac.wordpress.org/browser/exclude-pages/trunk/exclude\_pages.php#L162 \*/ function ame\_toggle\_excludestatus() { check\_ajax\_referer( 'ame\_ajax\_validation', 'security' );  
if( !current\_user\_can( 'edit\_pages' ) ) { die(); return; Expand Down Expand Up @@ -955,9 +990,20 @@ function ame\_enqueue\_stuff\_edit() { wp\_enqueue\_script( 'ame\_gui-modificators', AME\_PLUGINFULLURL . "js/gui-modificators.js", array( 'sack' ), AME\_VERSION ); wp\_enqueue\_script( 'ame\_miscscripts', AME\_PLUGINFULLURL . "js/functions.js", array( 'sack' ), AME\_VERSION ); wp\_register\_script( 'ame\_miscscripts', AME\_PLUGINFULLURL . "js/functions.js", array( 'jquery', 'sack' ), AME\_VERSION ); wp\_enqueue\_script( 'ame\_miscscripts' ); wp\_localize\_script( 'ame\_miscscripts', 'ameAjaxSec', array( 'ajaxnonce' => wp\_create\_nonce( 'ame\_ajax\_validation' ) ) ); }  
add\_action( 'admin\_head', 'ame\_css\_admin\_header' ); Expand Down Expand Up @@ -1000,9 +1046,20 @@ function ame\_enqueue\_stuff\_linkmanager() { wp\_enqueue\_script( 'ame\_gui-modificators', AME\_PLUGINFULLURL . "js/gui-modificators.js", array( 'sack' ), AME\_VERSION ); wp\_enqueue\_script( 'ame\_miscscripts', AME\_PLUGINFULLURL . "js/functions.js", array( 'sack' ), AME\_VERSION ); wp\_register\_script( 'ame\_miscscripts', AME\_PLUGINFULLURL . "js/functions.js", array( 'jquery', 'sack' ), AME\_VERSION ); wp\_enqueue\_script( 'ame\_miscscripts' ); wp\_localize\_script( 'ame\_miscscripts', 'ameAjaxSec', array( 'ajaxnonce' => wp\_create\_nonce( 'ame\_ajax\_validation' ) ) ); }  
add\_action( 'admin\_print\_scripts', 'ame\_js\_admin\_header' ); Expand All @@ -1015,9 +1072,20 @@ function ame\_enqueue\_stuff\_upload() { wp\_enqueue\_script( 'ame\_gui-modificators', AME\_PLUGINFULLURL . "js/gui-modificators.js", array( 'sack' ), AME\_VERSION ); wp\_enqueue\_script( 'ame\_miscscripts', AME\_PLUGINFULLURL . "js/functions.js", array( 'sack' ), AME\_VERSION ); wp\_register\_script( 'ame\_miscscripts', AME\_PLUGINFULLURL . "js/functions.js", array( 'jquery', 'sack' ), AME\_VERSION ); wp\_enqueue\_script( 'ame\_miscscripts' ); wp\_localize\_script( 'ame\_miscscripts', 'ameAjaxSec', array( 'ajaxnonce' => wp\_create\_nonce( 'ame\_ajax\_validation' ) ) ); }  
add\_action( 'admin\_print\_scripts', 'ame\_js\_admin\_header' ); Expand Down

CVE-2022-29450: 2.4.5 Release · oliverschloebe/admin-management-xtended@f94732d

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Vulnerable versions

<= 2.4.4

PSID 

bbb55cabc55b

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-05-27

**Details**

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered by Nguy Minh Tuan (Patchstack Alliance) in the WordPress Admin Management Xtended plugin (versions <= 2.4.4).

**Solution**

Update the WordPress Admin Management Xtended plugin to the latest available version (at least 2.4.5).

**References**

CVE-2022-29450 Plugin page

CVE-2022-29450: WordPress Admin Management Xtended plugin <= 2.4.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities - Patchstack

Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.

 Not fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Software

Promotion Slider

Vulnerable versions

<= 3.3.4

PSID 

8b23bfdb3722

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires contributor or higher role user authentication.

Publicly disclosed

2022-05-26

**Details**

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities were discovered by Ngo Van Thien (Patchstack Alliance) in the WordPress Promotion Slider plugin (versions <= 3.3.4).

**Solution**

Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

**References**

CVE-2022-29440 Plugin page

CVE-2022-29440: WordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities - Patchstack

Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

Wasn't getting email notifications when a message was sent to inbox. Found in send-page.php (plugins/pm4wp/inc/send-page.php) the following code... $recipient\_email = $wpdb->get\_var( "SELECT user\_email from $wpdb->users WHERE display\_name = '$rec'" ); ...on line 120 needed to be changed with... $recipient\_email = $wpdb->get\_var( "SELECT user\_email from $wpdb->users WHERE user\_login = '$rec'" ); ...as it was trying to pull with username, not display name. Hope this helps anyone running into the same issue.

Read all 11 reviews

“Private Messages For WordPress” is open source software. The following people have contributed to this plugin.

Contributors

*    Anh Tran

CVE-2022-29442: Private Messages For WordPress

Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

PSID 

2d3ab1d81ae9

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-06-08

**Details**

CSRF vulnerability leading to Google Maps API key update discovered by Rasi Afeef (Patchstack Alliance) in WordPress API KEY for Google Maps plugin (versions <= 1.2.1).

**Solution**

Update the WordPress API KEY for Google Maps plugin to the latest available version (at least 1.2.2).

**References**

Changeset

CVE-2022-29453: WordPress API KEY for Google Maps plugin <= 1.2.1 - CSRF vulnerability leading to Google Maps API key update - Patchstack

Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

This plugin provides 1 block.

*   Slider

Not possible to use youtube video

Its Very Easy – and super classy – got it on my first try – was able to adjust it exactly the way i wanted it . . I HIGHLY Recommend.

This is basically all i needed for my website.Thanks lot!

awesome support and functional plugin!

I use this plugin literally on all of my WP websites

This is one of the plugins I install for my client's websites as it is not complicated even for beginners.

Read all 9 reviews

“Image Slider by NextCode – Photo & Video SLider” is open source software. The following people have contributed to this plugin.

Contributors

*    NextCode

CVE-2022-29438: Image Slider by NextCode – Photo & Video SLider

Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides.

 Not fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Software

Image Slider by NextCode

Vulnerable versions

<= 1.1.2

PSID 

8f6d0a17dc52

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-05-26

**Details**

Slider Deletion via Cross-Site Request Forgery (CSRF) vulnerability discovered by Ngo Van Thien (Patchstack Alliance) in WordPress Image Slider by NextCode plugin (versions <= 1.1.2).

**Solution**

Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

**References**

CVE-2022-29439 Plugin page

CVE-2022-29439: WordPress Image Slider by NextCode plugin <= 1.1.2 - Slider Deletion via Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.

 Not fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Software

Image Slider by NextCode

Vulnerable versions

<= 1.1.2

PSID 

298a34c5dadc

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-05-26

**Details**

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered by BEE-K (Patchstack) in the WordPress Image Slider by NextCode plugin (versions <= 1.1.2).

**Solution**

Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

**References**

CVE-2022-29437 Plugin page

CVE-2022-29437: WordPress Image Slider by NextCode plugin <= 1.1.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities - Patchstack

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Monitoring Coming soon

Vulnerable versions

<= 2.17.0

PSID 

a28473c55146

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Publicly disclosed

2021-10-25

**Details**

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability was discovered by Nguyen Van Khanh (Patchstack Alliance) in the WordPress Age Gate plugin (versions <= 2.17.0).

**Solution**

Update the WordPress Age Gate plugin to the latest available version (at least 2.17.1).

**References**

CVE-2021-36901 Plugin changelog

Tag

#wordpress