WordPress: Stored Cross-Site Scripting Vulnerability in igumbi Online Booking Plugin

In igumbi Online Booking plugin for WordPress versions 1.40 and prior a medium severity vulnerability CVE-2024-13455 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to exploit Stored Cross-Site Scripting (XSS) via the ‘igumbi_calendar’ shortcode by injecting arbitrary web scripts that execute whenever a user accesses an affected page due to insufficient input sanitization and output escaping. To address this issue, users should upgrade igumbi Online Booking plugin to version 1.41. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13455.