CVE-2024-7129

published 2024-09-13

CVE-2024-7129: The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection…

Priority P3 43 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nsqua	simply_schedule_appointments	< 1.6.7.43	1.6.7.43

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1336