CVE-2018-8737

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.05.4Medium EPSS percentile44th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2018-03-17Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your business runs Bookme Control Panel 2.0 and whether staff can enter or view customer Name and Note fields.
Ask your software vendor whether Bookme Control Panel 2.0 is affected by CVE-2018-8737; no fixed version has been published in the available information.
Until a vendor remedy is available, restrict access to the Customers “Book Me” function to trusted staff and review existing Name and Note entries for suspicious code.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me" function. Within the Name and Note (aka custName and custNote) sections of the Customers screen, the application does not sanitize user-supplied input and renders injected JavaScript code to the user's browser.

In plain language

Written by AI from the record

Bookme Control Panel 2.0 can let a logged-in attacker plant harmful browser code in customer records, so businesses using it should take action.

Stored XSS in Bookme Control Panel 2.0 allows a low-privileged authenticated user to inject JavaScript through Customers “Book Me” Name or Note fields, which executes when another user views the record.

If you're affected

Staff account actions
Customer record exposure
Unauthorized data changes
Customer-service disruption

What is it

A person with access to the customer screen can hide harmful instructions inside a customer name or note. It is like slipping a booby-trapped note into a customer file: when another staff member opens it, the note can make their web browser do things under their account.

Who is affected

This matters to you if you run Bookme Control Panel 2.0 and use its Customers “Book Me” function. It requires an attacker to already have a login and a staff member to view the altered customer record.

How urgent is it

Attackers can use a publicly available exploit to take advantage of this weakness after obtaining a valid login. Treat this as an amber priority: limit access now and get a vendor remediation plan, but it is not listed as actively exploited by CISA.

What to do — in detail

Confirm exposure by identifying installations of Bookme Control Panel 2.0 and checking whether the Customers “Book Me” Name (custName) and Note (custNote) fields are in use. Test only in a safe environment or have the vendor confirm whether user-entered values are encoded before being displayed.

No vendor patch, fixed version, or supported upgrade target is available in the findings. Contact the vendor for a supported remediation path rather than applying an unverified third-party change.

If patching is delayed, restrict creation and editing of customer records to trusted accounts, remove suspicious markup or script-like content from existing Name and Note fields, and limit which staff can view these records. Review application and web-server logs for unusual edits to customer records and investigate reports of unexpected browser prompts, redirects, or actions. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2018-8737 is CWE-79 stored cross-site scripting in Bookme Control Panel 2.0. CVSS v3.0 is 5.4 (Medium): AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. An authenticated low-privilege attacker can place unsanitized JavaScript in custName or custNote; execution requires a victim to render the stored value. One public exploit is known. It is not in CISA KEV. EPSS predicts 0.5% likelihood (44th percentile) and the trend is flat; this is predictive data, not evidence of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS44th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 44th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 2911 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: other
2024-11-21Record updated
2018-03-17Publishedweakness classified, att&ck mapped

Affected products

bylancercommercial
- bookmeMixedWeb & CMS Plugins / wordpress-plugin

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Scored 5.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact