CVE-2023-39918: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in SAASPROJECT's Booking Package WordPress plugin, affecting versions 1.6.01 and below. The vulnerability was identified on July 14, 2023, and publicly disclosed on August 7, 2023. This security flaw was assigned the identifier CVE-2023-39918 (Patchstack).

The vulnerability stems from improper sanitization and escaping of the 'mode' parameter before it is output back in the page. This security flaw has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has received varying CVSS v3.1 severity ratings: NIST assigned a score of 6.1 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack rated it at 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD, WPScan).

The vulnerability could allow malicious actors to inject arbitrary scripts, which could be used to execute various attacks against high-privilege users such as administrators. This could potentially lead to the injection of malicious redirects, advertisements, and other HTML payloads that would be executed when guests visit the affected site (Patchstack).

The vulnerability has been patched in version 1.6.02 of the Booking Package plugin. Users are strongly advised to update to this version or later to resolve the security issue. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).