Security readout for executives and security teams
Plain-English summary
CVE-2023-51520 is a stored cross-site scripting issue in the WordPress WP Booking Calendar plugin before 9.7.4. A lower-privileged user could store malicious content that later runs in another user’s browser. Business impact is usually limited, but admin session exposure or site content changes are possible.
Executive priority
Treat as a normal-priority WordPress plugin remediation unless the plugin is used on high-value or heavily delegated sites. Patch during the next maintenance window, sooner where many users can submit booking data or administrators frequently review submissions.
Technical view
The issue is CWE-79 improper neutralization during web page generation in WPdevelop / Oplugins WP Booking Calendar. CVSS 3.1 is 6.5, with network access, low attack complexity, low privileges, required user interaction, changed scope, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to WordPress sites running the Booking Calendar plugin, package slug booking, below version 9.7.4. Risk depends on whether untrusted or low-privileged users can submit plugin data that is later viewed by admins or other users.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Stored XSS typically requires a malicious entry to be saved and then viewed by another user, but the provided sources do not identify the exact vulnerable field or workflow.
Researcher notes
Evidence is enough to classify affected versions and impact, but incomplete for exact vulnerable parameter, exploit prerequisites beyond CVSS, and field-level validation. Avoid assuming public exploit availability or active exploitation from the supplied sources.
Mitigation direction
- Update WP Booking Calendar to version 9.7.4 or later.
- Check Patchstack and vendor guidance for any additional remediation notes.
- Limit plugin administration and booking-management access to trusted users.
- Review WordPress roles that can create or edit booking content.
- Use existing web security controls to reduce XSS impact where available.
Validation and detection
- Inventory WordPress sites using the Booking Calendar plugin.
- Confirm installed plugin versions are 9.7.4 or later.
- Identify sites where low-privileged users can submit booking-related content.
- Review recent booking content for unexpected script-like markup.
- Retest after update using a non-destructive XSS validation approach.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-51520 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.