WordPress Booking Calendar Pro plugin <= 11.2.19 - Reflected Cross-Site Scripting via 'calendar_id' vulnerability

Reflected Cross-Site Scripting via 'calendarid' vulnerability discovered by vgo0 in WordPress Plugin Booking Calendar Pro WpDevArt versions = 11.2.19...

CVE-2024-12077: Improper Neutralization of Input During Web Page Generation

The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendarid’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it...

PT-2025-1743

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 3.2.19 Booking Calendar Pro versions prior to 11.2.19 Description The issue concerns a Reflected Cross-Site Scripting vulnerability via the calendar id parameter due to insufficient input sanitization and...