CVE-2024-12469: WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameter
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12469?
CVE-2024-12469 has a medium severity level due to reflected cross-site scripting vulnerabilities.
How do I fix CVE-2024-12469?
To fix CVE-2024-12469, update the WP BASE Booking of Appointments, Services and Events plugin to version 4.9.2 or later.
Which versions are affected by CVE-2024-12469?
CVE-2024-12469 affects all versions of the WP BASE Booking of Appointments, Services and Events plugin up to and including version 4.9.1.
What is reflected cross-site scripting in the context of CVE-2024-12469?
Reflected cross-site scripting in CVE-2024-12469 allows malicious scripts to be executed on the user’s browser via the 'status' parameter due to insufficient input validation.
Who is the vendor for CVE-2024-12469?
The vendor for CVE-2024-12469 is WP BASE, the company behind the Booking of Appointments, Services and Events plugin.