The vulnerability CVE-2024-51873 affects the Multi-day Booking Calendar plugin by Masashi Takizawa, allowing an attacker to perform DOM-based Cross-site Scripting (XSS) attacks. This occurs because the plugin does not properly neutralize user input when generating web pages, enabling injection of malicious scripts. The issue impacts versions up to 1.0.1. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low complexity, required privileges, user interaction, and impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system through DOM-based XSS. This may allow attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, data manipulation, or denial of service. However, exploitation requires user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges of users interacting with the plugin and avoid exposing it to untrusted users. Monitor for updates from the vendor or trusted security sources for an official patch or mitigation instructions.