Reflected Cross-Site Scripting Vulnerability in Appointments and Events Plugin by WordPress
CVE-2024-12737
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 26 February 2025
Badges
Summary
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability, which occurs due to inadequate sanitization and escaping of parameters before they are displayed on web pages. This flaw primarily affects high privilege users, including administrators, potentially allowing attackers to inject malicious scripts that get executed in the users' browsers during page interactions. Users are urged to update to the latest version to mitigate the risk of exploitation.
Affected Version(s)
WP BASE Booking of Appointments, Services and Events 0 < 5.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved