CVE-2024-10893

Summary

CVE-2024-10893 is a vulnerability affecting the WP Booking Calendar plugin for WordPress. Prior to version 10.6.5, the plugin fails to sanitize and escape certain settings, making it susceptible to Stored Cross-Site Scripting (XSS) attacks. This issue poses a significant risk, as even users with high privileges, such as administrators, are susceptible to exploitation. The vulnerability can persist in multisite setups, where the "unfiltered_html" capability is intentionally disallowed. This weakness allows attackers to inject malicious scripts into the plugin, potentially gaining unauthorized access or stealing sensitive data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.