CVE-2024-8274

The WP Booking Calendar plugin for WordPress contains a security flaw affecting all versions up to 10.5, allowing malicious actors to inject unauthorized code onto legitimate websites through the 'timeline_obj' parameter. This vulnerability stems from inadequate validation of input data and failure to properly encode output, creating an opportunity for attackers to deceive users into executing malicious scripts by manipulating certain parameters.

Based on public CVE data (MITRE/NVD).