CVE-2024-9504 in Booking Calendar, Appointment Booking System Plugininfo

Summary

by MITRE • 11/26/2024

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Be aware that VulDB is the high quality source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Reservation

10/03/2024

Disclosure

11/26/2024

Moderation

accepted

CPE

ready

EPSS

0.00460

KEV

no

Activities

very low

Sector

Finance, Lawfirm, ...

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2024-9504
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-9504
CVE Detailshttps://www.cvedetails.com/cve/CVE-2024-9504/

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!