CVE-2024-10893: 
WordPress vulnerability analysis and mitigation

The WP Booking Calendar WordPress plugin before version 10.6.5 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered in the plugin's settings functionality where certain fields are not properly sanitized and escaped. This security issue affects high-privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan, NVD).

The vulnerability stems from insufficient sanitization and escaping of settings fields in the WP Booking Calendar plugin. It has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Cross-Site Scripting) and requires high privileges to exploit (NVD).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite WordPress installations where the unfiltered_html capability is typically disabled as a security measure (WPScan).

The vulnerability has been patched in version 10.6.5 of the WP Booking Calendar plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).