CVE Database /
CVE-2024-9306
CVE · Medium
CVE-2024-9306 — Booking Calendar [booking] < 10.6.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-9306
|
Booking Calendar [booking] < 10.6.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 10.6.1
|
10.6.1 |
2024-10-03 |
—
|
CVE-2024-9306
The WP Booking Calendar WordPress plugin contains a security flaw that allows malicious code injection through admin settings in versions up to 10.6. This is due to inadequate filtering of input data, allowing attackers to embed executable scripts on pages visited by other users. The vulnerability specifically affects multi-site setups and installations where HTML content has been restricted.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings