CVE-2024-11855

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-118563.7A security vulnerability in HPE IceWall products could be exploited remotely to cause Unauthorized Data Modification.CVE-2024-118577.8Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link wi CVE-2024-118587.8A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble A CVE-2024-118598.4DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link libr CVE-2024-11865.5A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the com CVE-2024-118606.5A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown par CVE-2024-118619.8EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.CVE-2024-118625.1Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption CVE-2024-118635.3Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault CVE-2024-118647.5Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault CVE-2024-118656.4The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient i CVE-2024-118666.4The BMLT Tabbed Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_tabbed_map' shortcode in all ve