CVE-2025-24732: BookingPress DOM-Based XSS Vulnerability

CVE-2025-24732 Overview

CVE-2025-24732 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the bookingpress-appointment-booking plugin by reputeinfosystems. The flaw affects all BookingPress versions up to and including 1.1.25. It results from improper neutralization of input during web page generation [CWE-79], allowing an authenticated attacker with low privileges to inject script content that executes in a victim's browser after user interaction. Successful exploitation can lead to session data theft, unauthorized actions performed in a victim's context, and further compromise across the WordPress site because the scope is changed.

Critical Impact

Low-privileged attackers can craft payloads that execute arbitrary JavaScript in a victim's browser session, enabling limited confidentiality and integrity impact against WordPress users interacting with BookingPress content.

Affected Products

• reputeinfosystems BookingPress (bookingpress-appointment-booking) WordPress plugin
• BookingPress versions from unspecified initial release through 1.1.25
• WordPress sites running the free edition of BookingPress

Discovery Timeline

• 2025-01-24 - CVE-2025-24732 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24732

Vulnerability Analysis

The vulnerability resides in the client-side rendering logic of the BookingPress plugin. User-controllable input flows into a DOM sink without proper neutralization, allowing script content to be evaluated by the browser during page generation. Because the sink executes in the client, the payload never needs to traverse server-side sanitization filters that WordPress typically applies to stored input. Exploitation requires an authenticated user session with low privileges and user interaction, such as visiting a crafted URL or booking page.

The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The changed scope in the CVSS vector reflects that injected script can impact resources beyond the vulnerable component, including other WordPress users and administrative surfaces reachable in the same origin.

Root Cause

The plugin's front-end code writes attacker-influenced data into the Document Object Model without applying context-appropriate escaping or a safe DOM API. Instead of using text-based DOM insertion methods such as textContent, the code likely uses sinks such as innerHTML or jQuery .html() that parse and execute HTML. This design choice allows a payload containing <script> tags or event-handler attributes to execute when the DOM is updated.

Attack Vector

An attacker with a low-privileged BookingPress account crafts input containing a JavaScript payload, then delivers a link or interaction path that causes the victim's browser to render the malicious DOM. When the victim loads the affected view, the payload executes in the context of the WordPress site. Because scope is changed, the executed script can act against other users of the site, including administrators who visit the booking interface. Detailed advisory information is available in the Patchstack WordPress Plugin Vulnerability entry.

No verified public proof-of-concept code is currently available. The vulnerability manifests in a client-side DOM sink within BookingPress rendering routines; see the security advisory for technical details.

Detection Methods for CVE-2025-24732

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or DOM event handlers (onerror, onload, onmouseover) appearing in BookingPress booking, service, or form fields.
• Outbound browser requests from administrator sessions to unfamiliar domains shortly after viewing BookingPress pages.
• WordPress user accounts created, elevated, or modified without corresponding administrator activity in access logs.
• HTTP referrers pointing to BookingPress endpoints preceding suspicious wp-admin requests.

Detection Strategies

• Inspect stored BookingPress records in the WordPress database for HTML markup or script fragments in fields that should contain plain text.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from BookingPress pages.
• Review web server access logs for authenticated POST requests to BookingPress endpoints containing encoded angle brackets or script keywords.

Monitoring Recommendations

• Alert on anomalous session behavior for WordPress administrator accounts, including new API tokens or plugin installations after visiting BookingPress pages.
• Track plugin version telemetry across WordPress inventory to identify hosts still running BookingPress 1.1.25 or earlier.
• Correlate browser error telemetry with CSP violation reports to identify attempted payload execution.

How to Mitigate CVE-2025-24732

Immediate Actions Required

• Upgrade the BookingPress plugin to a version later than 1.1.25 as soon as the vendor patch is available and validated.
• Audit BookingPress user roles and disable or restrict low-privileged accounts that are not required for business operations.
• Review stored BookingPress content for injected HTML or JavaScript and sanitize any suspicious records.

Patch Information

According to the Patchstack advisory, the vulnerability affects BookingPress through 1.1.25. Administrators should apply the latest vendor release from the WordPress plugin repository and confirm the installed version after upgrade.

Workarounds

• Deploy a strict Content Security Policy that disallows inline scripts and untrusted external script sources on pages rendering BookingPress content.
• Place the WordPress site behind a web application firewall (WAF) with rules that block common XSS payload patterns targeting the plugin endpoints.
• Temporarily deactivate the BookingPress plugin on high-value WordPress instances until the patched version is deployed and validated.

# Configuration example: enforce a restrictive CSP header via Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"