CVE-2024-0698

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-0698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-0698
Published
2024-03-05T01:55:59.881Z
Modified
2026-07-15T01:49:08.240162762Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Details

The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0698.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "1.3.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "Wordfence"
}
References

Affected packages

Git
github.com/alextselegidis/easyappointments

Affected ranges

Type
GIT
Repo
https://github.com/alextselegidis/easyappointments
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c68fe9fb0cd9d7653a32edb6bcb5b6d8926585aa
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.2"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:easyappointments:easy\\!appointments:*:*:*:*:*:wordpress:*:*"
}

Affected versions

1.*
1.1.0
1.1.0-beta.2
1.1.1
1.2.0
1.2.1
1.3.0
1.3.1
1.3.1-beta.1
1.3.2-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0698.json"
github.com/alextselegidis/easyappointments-wordpress

Affected ranges

Type
GIT
Repo
https://github.com/alextselegidis/easyappointments-wordpress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1c4f54533c3fad81cb78b10da32326eb426bab5e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.2"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:easyappointments:easy\\!appointments:*:*:*:*:*:wordpress:*:*"
}

Affected versions

1.*
1.0.0
1.0.0-apha.1
1.0.0-beta.1
1.0.1
1.1.0
1.1.1
1.2.0
1.3.0
1.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0698.json"