Stored Cross-Site Scripting in WP Booking Calendar Plugin by WordPress

CVE-2025-4669

What is CVE-2025-4669?

The WP Booking Calendar plugin for WordPress contains a vulnerability allowing stored cross-site scripting (XSS). This flaw arises from inadequate input sanitization and output escaping on user-supplied attributes in the plugin’s wpbc shortcode. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, which will execute when other users access the affected pages, potentially compromising user security and data integrity.

References