CVE-2024-8663: WP Simple Booking Calendar XSS Vulnerability

CVE-2024-8663 Overview

CVE-2024-8663 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WP Simple Booking Calendar plugin for WordPress. The flaw exists in all versions up to and including 2.0.10. It stems from the use of add_query_arg and remove_query_arg without proper URL escaping. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the user clicks a crafted link. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of an authenticated administrator, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site.

Affected Products

WP Simple Booking Calendar plugin for WordPress, versions up to and including 2.0.10
Vulnerable file: includes/base/admin/calendar/views/view-edit-calendar.php
Vulnerable file: includes/modules/update-checker/views/view-register-website.php

Discovery Timeline

2024-09-13 - CVE-2024-8663 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8663

Vulnerability Analysis

The vulnerability affects two administrative views within the WP Simple Booking Calendar plugin. Both call the WordPress helper functions add_query_arg() and remove_query_arg() and echo the resulting URL back into the page without escaping. WordPress documentation explicitly warns that these functions return unsanitized data derived from the current request URL. When attacker-controlled query string parameters are reflected in the page, arbitrary HTML and JavaScript can be injected. Exploitation requires user interaction, typically an administrator clicking a specially crafted link.

Root Cause

The root cause is missing output encoding on URLs returned by add_query_arg and remove_query_arg. These functions preserve any existing query parameters from $_SERVER['REQUEST_URI'], including hostile input. Without wrapping the output in esc_url() before rendering, injected characters such as ", <, and > break out of the surrounding HTML attribute and execute as script content.

Attack Vector

An unauthenticated attacker crafts a URL pointing to a vulnerable admin page containing an XSS payload in a query parameter. The attacker delivers the link through phishing, social media, or a hostile third-party site. When a logged-in administrator follows the link, the plugin renders the tainted URL inside the page, and the injected script executes with the administrator's session context. See the Wordfence Vulnerability Report and the vulnerable code in view-edit-calendar.php and view-register-website.php for the affected sinks.

Detection Methods for CVE-2024-8663

Indicators of Compromise

Web server access logs containing requests to WP Simple Booking Calendar admin pages with suspicious query string parameters such as "><script>, javascript:, onerror=, or URL-encoded equivalents.
Referer headers on admin requests pointing to untrusted external domains.
Unexpected administrative actions such as new user creation, plugin installation, or theme modification shortly after an admin follows an external link.

Detection Strategies

Inspect HTTP request logs for reflected payloads targeting admin.php or plugin-specific query parameters that render inside href or src attributes.
Monitor WordPress audit logs for admin-context state changes that lack a corresponding legitimate navigation flow.
Deploy a Web Application Firewall (WAF) rule to identify script-injection patterns in query strings destined for /wp-admin/.

Monitoring Recommendations

Track outbound requests from browsers to unfamiliar domains that follow admin-panel activity, which may indicate cookie or token exfiltration.
Alert on installations of the WP Simple Booking Calendar plugin at versions at or below 2.0.10 across managed WordPress inventories.
Correlate phishing detections referencing WordPress admin URLs with the presence of the vulnerable plugin.

How to Mitigate CVE-2024-8663

Immediate Actions Required

Update the WP Simple Booking Calendar plugin to a version above 2.0.10 that contains the vendor patch.
Audit all WordPress sites for the plugin and prioritize instances where administrative users regularly access the affected admin views.
Force logout of active administrator sessions after upgrading to invalidate any tokens that could have been captured.

Patch Information

The vendor addressed the issue by adding proper URL escaping to the affected admin views. Details are available in the WordPress Plugin ChangeSet. Administrators should install the fixed release through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict access to /wp-admin/ by IP allowlist at the reverse proxy or WAF layer to limit exposure to trusted operators.
Deploy a WAF rule that blocks common XSS payloads in query strings targeting WordPress admin endpoints.
Deactivate the WP Simple Booking Calendar plugin until the patched version is applied if administrator interaction with the affected views cannot be avoided.

bash

# Update the plugin using WP-CLI
wp plugin update wp-simple-booking-calendar

# Verify the installed version is above 2.0.10
wp plugin get wp-simple-booking-calendar --field=version

# If a patched version is not yet available, deactivate the plugin
wp plugin deactivate wp-simple-booking-calendar