CVE-2025-31604: Cal.com Stored XSS Vulnerability

CVE-2025-31604 Overview

CVE-2025-31604 is a stored cross-site scripting (XSS) vulnerability in the Cal.com WordPress plugin (cal-com). The flaw stems from improper neutralization of script-related HTML tags in web page output [CWE-80]. Attackers with low-privileged authenticated access can inject malicious script payloads that persist in the application and execute in the browsers of other users who view the affected content. The issue affects all versions of the Cal.com plugin from an unspecified initial release through version 1.0.0.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the WordPress site context.

Affected Products

Cal.com WordPress plugin (cal-com)
All versions up to and including 1.0.0
WordPress sites with the Cal.com plugin installed and active

Discovery Timeline

2025-03-31 - CVE-2025-31604 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31604

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw categorized under [CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)]. The Cal.com plugin fails to properly sanitize or encode user-supplied input before storing it and rendering it back in HTML output. An attacker with low privileges submits crafted input containing <script> tags or event-handler attributes. The plugin persists this payload in the WordPress database. When another user, including administrators, loads the page containing the tainted data, the browser parses and executes the injected script.

Exploitation requires user interaction, meaning a victim must load the affected page. The scope is changed, indicating the injected script can affect resources beyond the vulnerable component's security context. Successful exploitation compromises confidentiality, integrity, and availability at a limited level, typically through session theft, forced actions, or client-side defacement.

Root Cause

The root cause is missing or insufficient output encoding on user-controllable fields rendered by the Cal.com plugin. The plugin does not neutralize HTML markup characters such as <, >, and quotation marks when displaying stored content. WordPress provides sanitization functions such as esc_html(), esc_attr(), and wp_kses() that developers must apply at the output boundary. The affected code paths omit these calls, allowing raw script tags to reach the DOM.

Attack Vector

The attack is network-based and requires an authenticated account with low privileges. An attacker submits a payload containing script markup through an input field exposed by the Cal.com plugin. The payload persists server-side. When a higher-privileged user, such as a site administrator, navigates to the page that renders the stored data, the injected JavaScript executes with the victim's session context. This enables cookie theft, cross-site request forgery against the admin panel, or plugin-level configuration changes.

No verified proof-of-concept code is publicly available for CVE-2025-31604.
Refer to the Patchstack advisory for additional technical details.

Detection Methods for CVE-2025-31604

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event-handler attributes (for example onerror=, onload=) stored in WordPress database tables associated with the Cal.com plugin.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading Cal.com plugin pages.
New or modified WordPress administrator accounts created without an authorized change record.
Anomalous session activity or authenticated API calls originating from administrator sessions.

Detection Strategies

Query the wp_posts, wp_postmeta, and Cal.com-specific tables for HTML markup patterns such as <script, onerror=, and onload= in fields that should contain plain text.
Deploy a web application firewall (WAF) rule that inspects requests to Cal.com plugin endpoints for script tag payloads.
Enable a Content Security Policy (CSP) in report-only mode and monitor violation reports for inline script executions on plugin-rendered pages.

Monitoring Recommendations

Log and review all POST requests to Cal.com plugin endpoints, focusing on parameter values containing HTML characters.
Alert on WordPress administrator session activity that follows navigation to plugin-rendered pages.
Track file integrity for WordPress core, plugins, and themes to detect post-exploitation persistence.

How to Mitigate CVE-2025-31604

Immediate Actions Required

Deactivate the Cal.com plugin on all WordPress sites running version 1.0.0 or earlier until a patched release is confirmed installed.
Audit all low-privileged user accounts and revoke access for accounts that do not require plugin interaction.
Force a password reset and invalidate active sessions for WordPress administrators who accessed the plugin during the exposure window.
Review the Patchstack Vulnerability Report for vendor guidance and patch availability.

Patch Information

At the time of NVD publication, the advisory identifies versions through 1.0.0 as affected and does not confirm a fixed release. Administrators should consult the Patchstack advisory and the plugin's WordPress.org page for updates. Apply the vendor patch as soon as it becomes available and validate installation by checking the plugin version in the WordPress admin interface.

Workarounds

Deactivate and remove the Cal.com plugin until an updated version resolves the XSS flaw.
Deploy a WAF rule that blocks HTTP requests containing script-tag patterns targeting the plugin's endpoints.
Restrict access to plugin-authored content pages using role-based access controls or IP allowlisting.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of injected payloads.

bash

# Example WordPress CLI commands to deactivate the vulnerable plugin
wp plugin deactivate cal-com
wp plugin status cal-com

# Example nginx snippet to block obvious script payloads in query strings
# (Place inside the relevant server block)
if ($args ~* "(<script|onerror=|javascript:)") {
    return 403;
}