PT-2025-1743 · Unknown · Wp Booking Calendar+1

Dale Mavers + 1 · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-12077

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 3.2.19 Booking Calendar Pro versions prior to 11.2.19

Description The issue concerns a Reflected Cross-Site Scripting vulnerability via the calendar id parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.

Recommendations For Booking Calendar versions prior to 3.2.19, update to version 3.2.19 or later to resolve the issue. For Booking Calendar Pro versions prior to 11.2.19, update to version 11.2.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the calendar id parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-12077

Affected Products

Booking Calendar

Wp Booking Calendar

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-12077 · Security Note
• https://t.me/cvenotify/106534 · Telegram Post
• https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.16/admin/views/Reservations.php#L532 · Note
• https://plugins.trac.wordpress.org/changeset/3209851 · Note
• https://t.me/cvedetector/14503 · Telegram Post
• https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.16/admin/views/Reservations.php#L528 · Note
• https://twitter.com/CVEnew/status/1876533417921384682 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/81cc09ee-da3d-407d-82c0-542b56df5aed?source=cve · Note