The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/997eb9f6-80e1-4bc5-be72-bd6a6f52379c/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
20 May 2025, 19:58
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wp-base wp Base Booking Of Appointments\, Services And Events
Wp-base |
|
| References | () https://wpscan.com/vulnerability/997eb9f6-80e1-4bc5-be72-bd6a6f52379c/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:wp-base:wp_base_booking_of_appointments\,_services_and_events:*:*:*:*:*:wordpress:*:* |
26 Feb 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-26 13:15
Updated : 2025-05-20 19:58
NVD link : CVE-2024-12737
Mitre link : CVE-2024-12737
JSON object : View
Products Affected
wp-base
- wp_base_booking_of_appointments\,_services_and_events
CWE
No CWE.