CVE-2024-3672: XSS
First published: Tue Apr 16 2024(Updated: )
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ba-booking Ba Book Everything | <1.6.9 | |
| WordPress BA Book Everything plugin | <=1.6.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2024-3672?
CVE-2024-3672 is a Stored Cross-Site Scripting vulnerability in the BA Book Everything plugin for WordPress that affects versions up to 1.6.8 due to inadequate input sanitization.
What are the potential impacts of CVE-2024-3672?
The potential impacts of CVE-2024-3672 include unauthorized script execution in the context of the user’s session, leading to data theft or site compromise.
How can I fix CVE-2024-3672?
To fix CVE-2024-3672, update the BA Book Everything plugin to version 1.6.9 or later, where the vulnerability has been addressed.
Who is affected by CVE-2024-3672?
All users of the BA Book Everything plugin for WordPress running version 1.6.8 or earlier are affected by CVE-2024-3672.
When was CVE-2024-3672 disclosed?
CVE-2024-3672 was disclosed in 2024, highlighting the need for immediate updates to affected WordPress plugin versions.
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/ba-booking
- canonical/ba-booking ba book everything
- vendor/wordpress
- canonical/wordpress ba book everything plugin