UNescorted Attack on WordPress Booking Plugin Allows Arbitrary Script Execution

CVE-2024-8663

Summary

The WP Simple Booking Calendar plugin for WordPress exhibits a vulnerability related to Reflected Cross-Site Scripting (XSS). This flaw arises from the inadequate handling of parameters within the functions add_query_arg and remove_query_arg, which may be exploited to inject malicious scripts into the pages of the affected application. If a user is lured into clicking on a crafted link, these scripts can execute within their browser session, resulting in potential unauthorized actions or data exposure without the need for user authentication. This vulnerability highlights the importance of proper input sanitization and parameter escaping in web application development.

References