CVE-2025-9346: Booking Calendar WordPress XSS Vulnerability

CVE-2025-9346 Overview

CVE-2025-9346 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Booking Calendar plugin for WordPress. The flaw affects all versions up to and including 10.14.1 and resides in the plugin's settings handling. Insufficient input sanitization and output escaping allow authenticated users with Administrator-level privileges to inject arbitrary web scripts. The injected scripts execute in the browser of any user who accesses the affected page.

Critical Impact
Authenticated administrators can inject persistent JavaScript into WordPress pages, enabling session hijacking, administrative action forgery, and malicious redirection in multi-admin or multisite environments.

Affected Products

Booking Calendar plugin for WordPress — all versions through 10.14.1
Fixed in the plugin changeset 3348957 within class-admin-settings-api.php
WordPress sites with multiple administrators or multisite deployments where privilege separation is expected

Discovery Timeline

2025-08-28 - CVE-2025-9346 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9346

Vulnerability Analysis

The Booking Calendar plugin exposes a settings interface backed by class-admin-settings-api.php. User-supplied settings values are stored and later rendered without adequate sanitization or output escaping. An authenticated attacker with Administrator-level access submits settings containing JavaScript payloads. The payload persists in the WordPress database and executes when any user loads a page that renders the affected setting.

The vulnerability requires authentication and elevated privileges, which limits the attacker population. However, the stored nature of the flaw means the payload executes repeatedly against every subsequent visitor to the injected page. In multisite or delegated-administration models, a lower-tier admin can target super admins, breaking the trust boundary that WordPress operators often assume.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render within the plugin's admin settings API. WordPress provides canonical helpers such as sanitize_text_field(), wp_kses(), and esc_attr() for exactly this purpose. The vulnerable code paths did not apply them consistently to settings values, allowing raw HTML and script content to persist and render in the DOM.

Attack Vector

An authenticated administrator submits a malicious payload through the plugin's settings form. The payload is written to the WordPress options table and later echoed into an admin or front-end page. When another user — typically another administrator — opens that page, the browser parses the injected markup and executes the attacker's script in the context of the WordPress origin. This permits CSRF token theft, cookie exfiltration, account takeover, and plugin or theme manipulation. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the technical fix details.

Detection Methods for CVE-2025-9346

Indicators of Compromise

Unexpected <script>, onerror, or onload strings inside WordPress wp_options rows associated with the Booking Calendar plugin
Outbound requests from admin browser sessions to unfamiliar domains shortly after loading plugin settings or booking pages
Newly created administrator accounts or modified user roles following administrator visits to injected pages
Modifications to plugin or theme files that correlate with an admin viewing a Booking Calendar page

Detection Strategies

Query the WordPress database for Booking Calendar option rows and inspect values for HTML or JavaScript syntax
Monitor web server logs for POST requests to plugin settings endpoints followed by anomalous GET traffic from admin sessions
Deploy a Content Security Policy (CSP) in report-only mode to surface inline-script violations originating from the WordPress admin

Monitoring Recommendations

Alert on changes to WordPress administrator account counts, roles, and capabilities
Log and review all plugin settings mutations, correlating the acting user with session metadata
Track the installed version of the Booking Calendar plugin across the estate and flag any instance at 10.14.1 or earlier

How to Mitigate CVE-2025-9346

Immediate Actions Required

Update the Booking Calendar plugin to the version released after changeset 3348957, which contains the sanitization fix
Audit all existing plugin settings for stored HTML or JavaScript and remove any unexpected content
Rotate credentials and session tokens for every administrator who may have viewed an injected page
Review recent administrator-level actions for signs of account takeover or unauthorized configuration changes

Patch Information

The maintainer resolved the issue in the Booking Calendar plugin via WordPress Plugin Changeset 3348957, which adds sanitization and escaping in class-admin-settings-api.php. Upgrade to the first released version that incorporates this changeset. Confirm the installed version through the WordPress admin Plugins page after upgrading.

Workarounds

Restrict Administrator-level accounts to a small, trusted set of users until the plugin is updated
Enforce a strict Content Security Policy that blocks inline scripts in the WordPress admin interface
Temporarily deactivate the Booking Calendar plugin if a patched version cannot be installed immediately
Require phishing-resistant multi-factor authentication for every administrator account to reduce the risk of credential-based lateral movement

bash

# Verify the installed Booking Calendar plugin version using WP-CLI
wp plugin get booking --field=version

# Update the plugin to the latest patched release
wp plugin update booking

# List administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered