Stored Cross-Site Scripting Vulnerability in Booking Calendar Plugin by WordPress

CVE-2025-9346

What is CVE-2025-9346?

The Booking Calendar plugin for WordPress exposes a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping practices. This security flaw affects all versions up to and including 10.14.1, allowing authenticated attackers with Administrator-level access or higher to inject malicious web scripts. These scripts can execute whenever a user accesses the compromised pages, posing significant security risks to site visitors.

References