CVE-2024-47360: BA Book Everything XSS Vulnerability

CVE-2024-47360 Overview

CVE-2024-47360 is a reflected cross-site scripting (XSS) vulnerability in the BA Book Everything WordPress plugin from bookingalgorithms. The plugin fails to properly neutralize user-controlled input during web page generation, allowing attackers to inject arbitrary scripts into rendered pages. The flaw affects all plugin versions up to and including 1.6.20. Exploitation requires user interaction, typically through a crafted link, and executes in the victim's browser under the vulnerable site's origin. The scope-changed impact allows the injected payload to affect resources beyond the vulnerable component.

Critical Impact

Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and administrative action hijacking on WordPress sites running BA Book Everything ≤ 1.6.20.

Affected Products

• BA Book Everything WordPress plugin versions through 1.6.20
• WordPress sites using bookingalgorithms BA Book Everything
• Any site rendering the vulnerable plugin's booking interfaces

Discovery Timeline

• 2024-10-06 - CVE-2024-47360 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47360

Vulnerability Analysis

The vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. BA Book Everything reflects user-supplied parameters into HTTP responses without applying context-appropriate output encoding. When a victim visits a crafted URL, the plugin echoes attacker-controlled content into the HTML document, and the browser parses that content as executable script.

The reflected variant of XSS requires the attacker to deliver a malicious URL to a target, typically through phishing, malvertising, or a compromised referrer. The injected script executes in the same origin as the WordPress site, granting the payload access to cookies, session storage, and Document Object Model (DOM) content.

Because the scope changes when the payload executes, the impact can extend beyond the plugin's own boundaries. An authenticated administrator viewing the crafted link can be forced to trigger privileged WordPress operations, including user creation or plugin modification, via cross-site request forgery (CSRF) chained from the XSS context.

Root Cause

The plugin does not sanitize or escape input before including it in generated web pages. WordPress provides output escaping helpers such as esc_html(), esc_attr(), and esc_url(), but the vulnerable code paths in versions ≤ 1.6.20 omit these calls or apply them in the wrong context.

Attack Vector

An unauthenticated attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by BA Book Everything. The attacker delivers the link to a target. When the target clicks the link, the plugin renders the payload into the response body or a HTML attribute, and the browser executes it. See the Patchstack advisory for parameter-level details.

Detection Methods for CVE-2024-47360

Indicators of Compromise

• Web server access logs containing requests to BA Book Everything endpoints with URL parameters holding <script>, javascript:, onerror=, or onload= substrings
• Outbound requests from user browsers to attacker-controlled domains immediately after visiting plugin URLs
• Unexpected WordPress administrative actions performed by legitimate admin sessions shortly after clicking external links

Detection Strategies

• Inspect HTTP query strings and POST bodies targeting BA Book Everything routes for HTML metacharacters and script fragments
• Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from plugin pages
• Correlate WordPress audit logs with web access logs to identify admin actions preceded by suspicious referrers

Monitoring Recommendations

• Alert on WordPress installations still running BA Book Everything ≤ 1.6.20 through asset inventory scans
• Monitor for the plugin identifier ba-book-everything in the WordPress wp-content/plugins directory across managed hosts
• Track EPSS drift for CVE-2024-47360; current EPSS is 0.29% but reflects the potential for automated scanning

How to Mitigate CVE-2024-47360

Immediate Actions Required

• Update BA Book Everything to a version later than 1.6.20 as soon as the vendor publishes a fixed release
• If no patch is available, deactivate and remove the plugin from all affected WordPress sites
• Audit administrator accounts for unauthorized changes made after October 2024

Patch Information

The advisory records the vulnerability affecting versions up to and including 1.6.20. Consult the Patchstack database entry for BA Book Everything for the most current fixed-version information and remediation guidance.

Workarounds

• Deploy a Web Application Firewall (WAF) rule that blocks requests to BA Book Everything endpoints containing script tags, event handlers, or javascript: URIs
• Enforce a strict Content Security Policy that disallows inline scripts on WordPress front-end pages
• Restrict administrative access to WordPress through IP allowlisting to reduce the reflected XSS blast radius against privileged users

# Example ModSecurity rule to block reflected XSS payloads targeting the plugin
SecRule REQUEST_URI "@contains /?ba-book-everything" \
  "chain,phase:2,deny,status:403,id:1047360,msg:'Blocked possible CVE-2024-47360 XSS payload'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"