CVE-2021-24225

Name of the Vulnerable Software and Affected Versions: Advanced Booking Calendar WordPress plugin versions prior to 1.6.7

Description: The issue is related to a reflected XSS problem. It occurs because the calId GET parameter in the "Seasons & Calendars" page is not properly sanitized before being output in an A tag.

Recommendations: For versions prior to 1.6.7, update to version 1.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Seasons & Calendars" page until the update is applied.