WP Booking Calendar, CVE-2024-10027

CVE, Research URL: CVE-2024-10027
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Published on: Nov 07, 2024
Research Description: The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected versions: Min -, max 10.6.3.
Status: vulnerable