CVE-2024-1484

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-14859.3A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks CVE-2024-14867.4Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices CVE-2024-14875.4The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wi CVE-2024-14887.3A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbo CVE-2024-14894.3The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and CVE-2024-14907.2An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO CVE-2024-14917.5The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file CVE-2024-14925.3The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to CVE-2024-14936.5An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and s CVE-2024-14956.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.CVE-2024-14965.4The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all CVE-2024-14975.4The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in al