CVE Database /
CVE-2024-6930
CVE · Medium
CVE-2024-6930 — Booking Calendar [booking] < 10.2.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-6930
|
Booking Calendar [booking] < 10.2.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 10.2.2
|
10.2.2 |
2024-07-23 |
—
|
CVE-2024-6930
The WP Booking Calendar plugin for WordPress contains a security flaw that allows malicious code injection through the 'type' attribute within the bookingform shortcode. This vulnerability affects all versions up to 10.2.1, where insufficient input validation and output protection enable attackers with contributor-level access or higher to embed arbitrary scripts in pages that will run when accessed by other users.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings