CVE-2024-7877

Summary

CVE-2024-7877 is a vulnerability affecting the Simply Schedule Appointments Booking Plugin for WordPress. Prior to version 1.6.7.55, the plugin fails to sanitize and escape certain Notification settings, making it susceptible to Cross-Site Scripting (XSS) attacks. These attacks could be carried out by high privilege users, including admins, even when the unfiltered_html setting is disabled. This issue poses a significant risk to WordPress websites using the vulnerable plugin version, potentially leading to unauthorized script injection and data theft. It is important for users to update the plugin as soon as possible to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.