Reflected Cross-Site Scripting Vulnerability in WP Datepicker for WordPress

CVE-2024-12468

What is CVE-2024-12468?

The WP Datepicker plugin for WordPress is prone to a vulnerability that allows for reflected cross-site scripting due to a flaw in the handling of the 'wpdp_get_selected_datepicker' parameter. This flaw arises from inadequate input sanitization and output escaping present in all versions up to and including 2.1.4. As a result, attackers could potentially inject arbitrary web scripts into pages that would execute if a user is manipulated into performing an action, such as clicking on a malicious link. This vulnerability emphasizes the importance of proper input sanitization and output escaping to safeguard web applications against unauthorized script execution.

References