Reflected Cross-Site Scripting Vulnerability in WP Datepicker for WordPress

CVE-2024-12468

What is CVE-2024-12468?

The WP Datepicker plugin for WordPress is prone to a vulnerability that allows for reflected cross-site scripting due to a flaw in the handling of the 'wpdp_get_selected_datepicker' parameter. This flaw arises from inadequate input sanitization and output escaping present in all versions up to and including 2.1.4. As a result, attackers could potentially inject arbitrary web scripts into pages that would execute if a user is manipulated into performing an action, such as clicking on a malicious link. This vulnerability emphasizes the importance of proper input sanitization and output escaping to safeguard web applications against unauthorized script execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References