Medium severity · published Nov 5, 2024
CVE-2024-7876
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin ·
before 1.6.7.55 · source: vendor
SS
Simply Schedule Appointments · Nsqua
before 1.6.7.55 · source: NVD
AB
Appointment Booking Calendar · Nsquared
before 1.6.7.55 · source: CISA
Affected product
AB
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7876
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7876
Exploit
https://wpscan.com/vulnerability/fffe862f-5bf0-4a05-9d32-caff0bfdb860/
More from Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
7.2
CVE-2024-7129
Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
4.8
CVE-2024-7877
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS