The Booking Calendar plugin for WordPress contains a stored cross‑site scripting vulnerability in the bookingcalendar shortcode that permits authenticated users with contributor or higher roles to insert arbitrary HTML or JavaScript. The flaw stems from inadequate input sanitization and output escaping of user‑supplied attributes, enabling injected scripts to run in the browsers of users who view the affected page, potentially leading to session hijacking or defacement.

The vulnerable product is the Booking Calendar plugin (vendor wpdevelop) for WordPress. All releases up to and including version 10.14.6 are affected; any installation running a version in this range could be exploited.

With a CVSS score of 6.4 the vulnerability carries a medium severity, and its EPSS score of less than 1% indicates a low likelihood of widespread exploitation at the time of analysis. The attack vector is limited to authenticated contributors or higher, meaning that the threat is confined to sites where such privileges exist, and the vulnerability is not listed in CISA's KEV catalog. An attacker would require access to the WordPress back‑end to inject the malicious payload and then rely on a victim visiting the page that contains the injected script to trigger the attack.