macsavers

That’s weird. It shows your version, 8.4.6. It’s the only booking plugin we have. So why would it it be a different plugin?

Here’s the full text they provide:

Booking 8.4.6
Severity: Critical

Category: xss

Summary: Bookly #1 WordPress Booking Plugin (Lite) <= 13.2 a€“ Unauthenticated Blind Stored XSS

Description: An unauthenticated user can inject arbitrary persistent javascript code in the admin panel.

That’s odd. It’s worked before and we didn’t change anything. Why would it just stop?

Here’s what we got from the form after we put in all the info. In fact, the from show properly, but the Reply-To which has the same code string doesn’t.

From: sherry McKineyy <[email protected]>
Subject: [your-subject]
Date: July 26, 2016 at 10:31:42 AM CDT
To: [email protected]
Reply-To: [your-email]

From: sherry McKineyy <[your-email]>
Subject: [your-subject]

Message Body:
[your-message]

—
This e-mail was sent from a contact form on HVAC Advantage (https://www.hvacadvantage.com)

See, that’s not the problem. What shows up is the tag. It’s not empty, it just won’t place the information in place the of the tag. Instead, we actually SEE the tag in the email.

There is a problem with this solution. If the plugin updates, the changes are lost.

I’m curious about this as well, but a bit further. I ran into an installation where they customized the theme default page in the plugin folder. The problem with this solution the developer came up with is that when there is an update to the plugin, the default page gets overwritten and the custom page is lost.

How can the page be customized without losing it when the plugin updates?