CVE Database /
CVE-2024-13323
CVE · Medium
CVE-2024-13323 — Booking Calendar [booking] < 10.9.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-13323
|
Booking Calendar [booking] < 10.9.3 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 10.9.3
|
10.9.3 |
2025-01-13 |
—
|
CVE-2024-13323
The Booking Calendar plugin for WordPress contains a stored cross-site scripting vulnerability in its booking shortcode affecting versions up to 10.9.2. Attackers with contributor privileges or higher can inject malicious scripts through insufficiently sanitized shortcode attributes, which then execute for all users viewing the affected pages. The vulnerability stems from inadequate input validation and output escaping of user-supplied data. The issue was patched in version 10.9.3.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings