CVE-2024-8797: 
WordPress vulnerability analysis and mitigation

The WP Booking System – Booking Calendar plugin for WordPress (CVE-2024-8797) contains a Reflected Cross-Site Scripting vulnerability affecting all versions up to and including 2.0.19.8. The vulnerability was discovered and disclosed on September 14, 2024, and is tracked with a CVSS v3.1 base score of 6.1 (Medium) (NVD).

The vulnerability stems from improper handling of the add_query_arg & remove_query_arg functions without appropriate URL escaping. This implementation flaw creates a potential attack vector where malicious scripts can be injected into web pages (Wordfence). The vulnerability has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

When successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. This could potentially lead to the compromise of user sessions or the execution of unauthorized actions on behalf of legitimate users (NVD).

The vulnerability requires user interaction for successful exploitation. An unauthenticated attacker needs to trick a user into performing a specific action, such as clicking on a specially crafted link, to execute the malicious script (NVD).

Users are advised to update their WP Booking System – Booking Calendar plugin to version 2.0.19.9 or later, which contains the security fix for this vulnerability (WordPress Plugin).