Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin, CVE-2024-7129

CVE, Research URL: CVE-2024-7129
Home page URL: Security reports for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Application: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Published on: Sep 13, 2024
Research Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
Affected versions: Min -, max 1.6.7.43.
Status: vulnerable