Stored Cross-Site Scripting Vulnerability in Booking Calendar Plugin for WordPress

CVE-2025-12804

What is CVE-2025-12804?

The Booking Calendar plugin for WordPress presents a Stored Cross-Site Scripting flaw due to inadequate input sanitization and output escaping on user-supplied attributes in the 'bookingcalendar' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript into pages. When a user accesses an affected page, the injected script can execute, potentially leading to unauthorized actions or data exposure.

References