CVE-2024-2101: 
WordPress vulnerability analysis and mitigation

CVE-2024-2101 affects the Salon Booking System WordPress plugin versions before 9.6.3. The vulnerability was discovered and disclosed on March 27, 2024, and involves a Stored Cross-Site Scripting (XSS) vulnerability in the plugin's appointment booking functionality (WPScan).

The vulnerability stems from improper sanitization and escaping of the 'Mobile Phone' field when booking an appointment. The CVSS v3.1 score is 5.7 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, indicating a network-accessible vulnerability requiring low attack complexity and user interaction (NVD).

When exploited, this vulnerability allows customers to conduct Stored Cross-Site Scripting attacks. The malicious script gets executed in the admin context when an administrator visits the 'Customers' page, potentially leading to unauthorized access to admin-level functionality (WPScan).

The vulnerability can be exploited by a customer during the appointment booking process. A proof of concept demonstrates that an attacker can inject malicious JavaScript code through the Mobile Phone field during the booking process at Step 5/7, which gets triggered when an admin visits the customers page at http://localhost/wp-admin/admin.php?page=salon-customers (WPScan).

The vulnerability has been patched in version 9.6.3 of the Salon Booking System WordPress plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).