CVE-2021-24232

CVE-2021-24232: Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)

Vendor Unknown

Product Advanced Booking Calendar

Weakness CWE-79 · XSS

Published April 22, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue

Key dates

02Disclosure timeline

April 22, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24232 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2022-4930 nuxsmin sysPass URL cross site scripting CVE-2023-4726 Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings CVE-2026-3041 xingfuggz BaykeShop Article Sidebar custom.html cross site scripting CVE-2023-48557 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-11224 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab