CVE-2024-12077
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Jan 7, 2025
CWE ID 79
Summary
CVE-2024-12077: This vulnerability affects the Booking Calendar and Booking Calendar Pro plugins for WordPress, versions 3.2.19 and 11.2.19 respectively. Attackers can exploit insufficient input sanitization and output escaping in the 'calendar_id' parameter, leading to Reflected Cross-Site Scripting (XSS). Unauthenticated attackers can inject arbitrary web scripts, potentially gaining control over user sessions and actions, by tricking users into performing certain actions like clicking on links.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.