CVE-2024-35297: 
WordPress vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in WP Booking plugin versions prior to 2.4.5. The vulnerability was reported on May 24, 2024, and was assigned CVE-2024-35297. This security flaw affects WordPress installations using the WP Booking plugin developed by aviplugins.com (JVN Report).

The vulnerability is classified as a stored cross-site scripting (CWE-79) issue. According to the CVSS 3.1 scoring, it received a base score of 4.7 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary scripts in the web browser of users accessing the website that uses the affected plugin. This could potentially lead to unauthorized access to user data or manipulation of the website content (JVN Report).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. No public exploits have been reported in the wild at the time of this assessment (NVD).

Users are advised to update the WP Booking plugin to version 2.4.5 or later to address this vulnerability. The update can be performed through the WordPress plugin management interface or by manually downloading and installing the latest version from the WordPress plugin repository (WordPress Plugin).