CVE-2023-48208

Name of the Vulnerable Software and Affected Versions Availability Booking Calendar version 5.0

Description A Cross Site Scripting issue allows an attacker to inject JavaScript via the name, plugin sms api key, plugin sms country code, uuid, title, or country name parameter to "index.php".

Recommendations For Availability Booking Calendar version 5.0, consider disabling the parameters name, plugin sms api key, plugin sms country code, uuid, title, and country name in the "index.php" file until a patch is available. Restrict access to the "index.php" file to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected endpoint until the issue is resolved.