PT-2024-38905 · WordPress · Wp Booking Calendar

Batfeats

+1

·

Published

2024-08-30

·

Updated

2024-09-03

·

CVE-2024-8274

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: WP Booking Calendar plugin for WordPress versions up to, and including, 10.5
Description: The issue is related to Reflected Cross-Site Scripting via several parameters from timeline obj due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Recommendations: For versions up to, and including, 10.5, consider disabling the timeline obj parameter until a patch is available to prevent exploitation. Restrict access to pages that utilize the timeline obj parameter to minimize the risk of arbitrary web script injection. Avoid using the timeline obj parameter in affected pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8274

Affected Products

Wp Booking Calendar