CVE-2024-8663 describes a reflected Cross-Site Scripting vulnerability in the WP Simple Booking Calendar WordPress plugin (up to version 2.0.10). The issue arises from the plugin's use of add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling unauthenticated attackers to inject malicious scripts. Successful exploitation requires user interaction, such as clicking a malicious link, which can lead to script execution in the context of the affected site.

An attacker can inject and execute arbitrary scripts in the context of the affected website, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. The vulnerability does not allow privilege escalation or denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to affected pages. Additionally, avoid clicking on suspicious links that could exploit this vulnerability. Monitor the vendor's channels for updates regarding patches or official mitigations.