CVE Database /
CVE-2025-64381
CVE · Medium
CVE-2025-64381 — Booking Calendar [booking] < 10.14.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-64381
|
Booking Calendar [booking] < 10.14.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.5
|
< 10.14.8
|
10.14.8 |
2025-11-13 |
—
|
CVE-2025-64381
The Booking Calendar plugin for WordPress contains a security flaw that enables malicious users with contributor-level permissions or higher to embed unauthorized code snippets into website content, which can then be executed by visitors when they access the compromised pages. This vulnerability stems from inadequate measures taken to cleanse and sanitize user input before it's displayed on the site. The issue affects all versions up to 10.14.7.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings