CVE-2024-7876

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 5, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-78774.8The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escapeCVE-2024-78784.8The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such aCVE-2024-78794.8The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such aCVE-2024-78815.1An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume thoseCVE-2024-78826.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-CoCVE-2024-78833.7When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers wCVE-2024-78847.5When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the executiCVE-2024-78857.5A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. TCVE-2024-78867.8A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerabiliCVE-2024-78874.9A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of CVE-2024-78884.3The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missiCVE-2024-78897.3Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows