CVE-2021-24232: 
WordPress vulnerability analysis and mitigation

The Advanced Booking Calendar WordPress plugin before version 1.6.8 contains an authenticated reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24232. The vulnerability was discovered and disclosed on March 30, 2021. The issue affects the plugin's settings page where license error messages are not properly sanitized before being output (WPScan).

The vulnerability exists due to insufficient sanitization of the license error message when output in the settings page. The issue is present in the file backend/settings.php at line 550. The vulnerability has a CVSS score of 7.1 (High) and is classified as CWE-79: Cross-Site Scripting. A proof of concept exploit involves accessing the path '/wp-admin/admin.php?page=advanced-booking-calendar-show-settings&setting=licenseKeyError&message=alert(123)' (WPScan).

When successfully exploited, this vulnerability allows authenticated attackers to inject and execute arbitrary web scripts in the context of other users' browsers who access the affected admin page. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated admin user (WPScan).

The vulnerability requires authentication to exploit, making it less severe than unauthenticated vulnerabilities. An attacker would need to have at least subscriber-level access to the WordPress installation to attempt exploitation (WPScan).

The vulnerability was fixed in version 1.6.8 of the Advanced Booking Calendar plugin. Site administrators should update to this version or later to protect against this security issue (WPScan).