CVE-2024-35297

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-352984.3Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to l CVE-2024-352997.5In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation CVE-2024-35306.1A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been declared as problematic. This vulnerabilit CVE-2024-353006.1In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible CVE-2024-353015.5In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token CVE-2024-353026.1In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible CVE-2024-353037.8A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (All CVE-2024-353049.8System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands.CVE-2024-353059.8Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through CVE-2024-353069.8OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pando CVE-2024-353079.8Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary cod CVE-2024-353088.8A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pand