CVE-2024-9306 is a stored Cross-Site Scripting vulnerability in the WP Booking Calendar plugin for WordPress, affecting all versions up to and including 10.6. The issue occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of admin settings input. This allows authenticated users with administrator privileges or those granted plugin management rights to inject arbitrary scripts that execute when the affected pages are viewed. The vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled.

An attacker with administrator-level permissions or higher can inject persistent malicious scripts into plugin settings, which execute in the context of users viewing the affected pages. This could lead to theft of user credentials, session hijacking, or other actions permitted by the victim's browser context. The impact is limited by the requirement for authenticated high-privilege access and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Administrators should review user permissions carefully, ensuring that only trusted users have administrator-level or plugin management access. Consider disabling multi-site installations or enabling unfiltered_html where appropriate as a temporary mitigation. Monitor vendor advisories for updates or patches addressing this issue.