CVE-2024-7129

Published: Sep 13, 2024Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

Affected (1)

Products: Nsqua: Simply Schedule Appointments

Nsqua

1 product

Simply Schedule Appointments

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nsqua Simply Schedule Appointments	Before 1.6.7.43

References (1)

https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/

Source: contact@wpscan.com

ExploitThird Party Advisory

Timeline

No history available yet.