CVE-2024-9504

Summary

CVE-2024-9504 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Booking calendar plugin for WordPress up to version 3.2.15. Malicious SVG files can be uploaded, exploiting insufficient input sanitization and output escaping. Attackers can inject arbitrary web scripts that execute whenever a user accesses the affected SVG file, posing a threat to unauthenticated users. This vulnerability could lead to data theft, unauthorized account access, and other malicious activities. Users are advised to update the plugin or consider alternative solutions to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.