CVE-2024-7876: Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7876?
CVE-2024-7876 has a medium severity rating due to its potential for Cross-Site Scripting attacks when exploited by high privilege users.
How do I fix CVE-2024-7876?
To fix CVE-2024-7876, update the Simply Schedule Appointments Booking Plugin to version 1.6.7.55 or later.
Which versions of the Simply Schedule Appointments Booking Plugin are affected by CVE-2024-7876?
CVE-2024-7876 affects versions of the Simply Schedule Appointments Booking Plugin prior to 1.6.7.55.
What kind of attack can be performed using the vulnerability CVE-2024-7876?
CVE-2024-7876 can allow high privilege users to perform Cross-Site Scripting attacks due to improper sanitization and escaping of settings.
Who are the potential attackers in CVE-2024-7876?
The potential attackers for CVE-2024-7876 are usually high privilege users, such as administrators, who can exploit the vulnerability.