Skip to content
Sign in
7.2 High

CVE-2024-7129 The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user…

Description

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

Affected products and versions

Product Affected versions Fixed in
appointment_booking_calendar 1.6 earliest → < 1.6.7.43 1.6.7.43
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin 1.6 earliest → < 1.6.7.43 1.6.7.43

Other CVEs of appointment_booking_calendar

The 3 CVEs of appointment_booking_calendar →
CVE-2024-7876 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not… 4.8 Medium CVE-2024-7877 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not… 4.8 Medium
Track this CVE