CVE-2025-24723: Booking Calendar Contact Form XSS Vulnerability

CVE-2025-24723 Overview

CVE-2025-24723 is a stored Cross-Site Scripting (XSS) vulnerability in the codepeople Booking Calendar Contact Form plugin for WordPress. The flaw affects all versions up to and including 1.2.55. Attackers with high-privilege access can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The vulnerability is tracked under CWE-79, improper neutralization of input during web page generation. Exploitation requires user interaction and results in a scope change, allowing the injected script to affect resources beyond the vulnerable component.

Critical Impact
Stored XSS enables session hijacking, credential theft through injected forms, and unauthorized actions performed in the context of authenticated WordPress users.

Affected Products

codepeople Booking Calendar Contact Form plugin for WordPress
All versions from initial release through 1.2.55
WordPress sites using the booking-calendar-contact-form plugin

Discovery Timeline

2025-01-24 - CVE-2025-24723 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24723

Vulnerability Analysis

The Booking Calendar Contact Form plugin fails to properly sanitize and escape user-supplied input before rendering it within web page output. An authenticated user with elevated privileges can submit crafted input containing HTML or JavaScript payloads. The plugin stores this input and later renders it without adequate encoding, causing the browser to execute the injected script.

Because the payload is stored server-side, every visitor loading the affected page triggers execution. The vulnerability requires user interaction, meaning a victim must load the injected content for the payload to fire. The scope change indicator reflects that injected scripts can access resources outside the plugin's isolation boundary, including cookies and DOM elements owned by the parent WordPress site.

Root Cause

The root cause is missing output encoding on stored user input rendered in HTML context. WordPress plugins should apply esc_html(), esc_attr(), or wp_kses() depending on the rendering context. The plugin's rendering paths omit these controls for one or more fields, allowing raw markup to reach the browser. The vendor advisory is available through Patchstack.

Attack Vector

The attack vector is network-based and requires an authenticated attacker with high privileges. The attacker submits a crafted payload through a plugin input field. The payload persists in the WordPress database. When a legitimate user, potentially an administrator, loads a page that renders the stored value, the injected JavaScript executes in that user's browser session. Refer to the Patchstack advisory for full technical context.

Detection Methods for CVE-2025-24723

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes stored in booking-calendar-related database tables
WordPress user sessions initiating unusual outbound requests to attacker-controlled domains after loading booking pages
Administrator accounts performing actions that were not manually initiated, such as new user creation or plugin installation

Detection Strategies

Review the WordPress wp_options and plugin-specific tables for entries containing HTML tags or JavaScript event attributes
Enable a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution
Scan plugin-rendered pages with static analysis tools that flag reflected or stored script payloads

Monitoring Recommendations

Alert on outbound requests from browsers loading /wp-admin/ pages to non-approved destinations
Monitor WordPress audit logs for privileged actions performed shortly after loading booking calendar pages
Track plugin version inventory across managed WordPress sites to identify installations at or below 1.2.55

How to Mitigate CVE-2025-24723

Immediate Actions Required

Identify all WordPress instances running the Booking Calendar Contact Form plugin at version 1.2.55 or earlier
Restrict administrative access to the plugin until a patched version is applied
Audit stored plugin data for injected payloads and remove suspicious entries

Patch Information

At the time of publication, consult the Patchstack advisory for the latest fixed release information. Update the plugin to a version later than 1.2.55 once the vendor publishes a patched release.

Workarounds

Deactivate and remove the plugin until a fixed version is available if business requirements allow
Deploy a web application firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in plugin input fields
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering plugin content
Limit high-privilege accounts to trusted administrators and enforce multi-factor authentication

bash

# Example WordPress WP-CLI commands to inventory and disable the plugin
wp plugin list --name=booking-calendar-contact-form --fields=name,status,version
wp plugin deactivate booking-calendar-contact-form