CVE-2024-7647

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing or incorrect nonce validation on the otasync_widget_settings_fnc() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
otasync	OTA Sync Booking Engine Widget	<= 1.2.7

References

Timeline

Published: Aug 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-76484.3The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the CVE-2024-76496.1The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and in CVE-2024-76506.3Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vu CVE-2024-76517.5The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-bu CVE-2024-76527.5An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory c CVE-2024-76546.1An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was a CVE-2024-76554.8The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Sc CVE-2024-76568.8The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deseri CVE-2024-76575.4A vulnerability classified as problematic was found in Gila CMS 1.10.9. This vulnerability affects unknown code of the file /cm/update_rows/CVE-2024-76585.3A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview CVE-2024-76597.5A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string CVE-2024-76606.1A vulnerability has been found in SourceCodester File Manager App 1.0 and classified as problematic. Affected by this vulnerability is an un