CVE-2025-12804 Overview
CVE-2025-12804 is a Stored Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin for WordPress. The flaw affects all plugin versions up to and including 10.14.6. It resides in the bookingcalendar shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when a user visits an affected page. The issue is tracked under CWE-79.
Critical Impact
Authenticated contributors can inject persistent JavaScript through shortcode attributes, enabling session theft, account takeover, or redirection of site visitors and administrators.
Affected Products
- Booking Calendar plugin for WordPress, versions up to and including 10.14.6
- WordPress sites permitting contributor-level or higher user registration
- Any WordPress installation rendering the bookingcalendar shortcode in published content
Discovery Timeline
- 2025-12-05 - CVE-2025-12804 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12804
Vulnerability Analysis
The Booking Calendar plugin exposes a bookingcalendar shortcode that accepts user-supplied attributes. The plugin processes these attributes without sufficient input sanitization and renders them without adequate output escaping. This allows an authenticated user with contributor privileges to embed the shortcode in post content and pass malicious payloads through its attributes.
When the affected page is rendered, the injected script executes in the browser context of any visitor, including administrators. This creates a persistent client-side execution primitive with cross-user reach. The vulnerability requires authentication and produces a scope change, meaning the injected code executes against browser resources belonging to victims who did not create the content.
Root Cause
The root cause is missing input validation and missing output encoding on shortcode attribute values. The plugin trusts attribute strings passed by post authors and interpolates them directly into HTML output. WordPress does not automatically sanitize shortcode attributes; that responsibility falls to the plugin. The plugin does not call esc_attr(), esc_html(), or an equivalent escaping routine before rendering.
Attack Vector
An attacker first obtains a contributor account through open registration or credential compromise. The attacker then creates a draft post containing the bookingcalendar shortcode with malicious payload data embedded in one of its attributes. Once the content is viewed, whether previewed by an editor or published, the payload executes in the victim's browser session.
Refer to the Wordfence Vulnerability Report for additional technical details on the attack path.
Detection Methods for CVE-2025-12804
Indicators of Compromise
- Post or page content containing bookingcalendar shortcode attributes with HTML entities, <script> fragments, or JavaScript event handlers such as onerror, onload, or onmouseover
- Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after viewing plugin-rendered pages
- New contributor or author accounts registered from anomalous IP addresses that immediately author shortcode-heavy content
Detection Strategies
- Audit the wp_posts table for shortcode occurrences of bookingcalendar containing suspicious attribute values, JavaScript URIs, or encoded payload markers
- Monitor web server logs for POST requests to /wp-admin/post.php and /wp-admin/post-new.php from contributor accounts that submit content with shortcode payloads
- Deploy Content Security Policy (CSP) reporting to surface inline script or event-handler violations on pages that embed the plugin shortcode
Monitoring Recommendations
- Track administrator session activity for anomalies such as password resets, plugin installs, or new admin account creation following visits to contributor-authored content
- Alert on modifications to WordPress user roles, particularly promotions from contributor to editor or administrator
- Correlate contributor authentication events with subsequent shortcode-bearing content creation for behavioral outliers
How to Mitigate CVE-2025-12804
Immediate Actions Required
- Update the Booking Calendar plugin to the version released after 10.14.6 that addresses this issue
- Review all existing pages and posts that embed the bookingcalendar shortcode for suspicious attribute content
- Audit contributor, author, and editor accounts and remove or reset any accounts that are unused, unrecognized, or created during the exposure window
Patch Information
The plugin author committed a fix in the WordPress plugin repository. Review the changeset for the exact code changes at the WordPress Plugin Changeset. Site operators should upgrade through the WordPress plugin management interface or via WP-CLI to the latest available release.
Workarounds
- Restrict contributor and author registration until the plugin is patched, and require administrator approval for new low-privilege accounts
- Temporarily deactivate the Booking Calendar plugin if a patched version cannot be applied immediately
- Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of any injected payload
- Apply a web application firewall rule that blocks shortcode attribute values containing <, >, javascript:, or on*= event handler patterns
# Update the Booking Calendar plugin via WP-CLI
wp plugin update booking
# Verify the installed version is later than 10.14.6
wp plugin get booking --field=version
# Search post content for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[bookingcalendar%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror=%');"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
