CVE-2024-5859: Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting
First published: Fri Jun 21 2024(Updated: )
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vcita Online Booking & Scheduling Calendar | <4.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5859?
CVE-2024-5859 is classified as a medium severity vulnerability due to its potential for reflected cross-site scripting.
How do I fix CVE-2024-5859?
To fix CVE-2024-5859, update the vcita Online Booking & Scheduling Calendar plugin to version 4.4.2 or later.
What are the risks associated with CVE-2024-5859?
The risks of CVE-2024-5859 include the possibility of attackers executing malicious scripts in the context of a user's browser.
Which versions are affected by CVE-2024-5859?
CVE-2024-5859 affects all versions of the vcita Online Booking & Scheduling Calendar plugin up to and including 4.4.2.
Is input sanitization a factor in CVE-2024-5859?
Yes, CVE-2024-5859 is due to insufficient input sanitization and output escaping in the plugin.
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/vcita
- canonical/vcita online booking & scheduling calendar