Now officially on WordPress.org

CVE Database / CVE-2023-51520

CVE · Medium

CVE-2023-51520 — Booking Calendar [booking] < 9.7.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2023-51520 Booking Calendar [booking] < 9.7.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.5 < 9.7.4 9.7.4 2023-09-25 —

CVE-2023-51520

The Booking Calendar plugin for WordPress contains a cross-site scripting (XSS) vulnerability in versions prior to 9.7.4 that could allow an attacker to inject and execute malicious scripts on the website. These injected scripts could perform various actions including redirects, display unwanted advertisements, or execute arbitrary HTML code that would run when visitors access the site. The vulnerability was discovered by Ngô Thiên An and has been patched in version 9.7.4 and later. Users should update to at least version 9.7.4 to remediate this security issue.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings