The Booking Calendar WordPress plugin contains an insufficiently sanitized attribute handler for its wpbc shortcode, allowing authenticated contributors and higher roles to store arbitrary JavaScript within page content. When a user later accesses the affected page, the injected script executes in the visitor’s browser under the context of the website, enabling attacks such as cookie theft, credential hijacking, or defacement. This vulnerability directly compromises the confidentiality and integrity of user data and may facilitate further malicious activity on the site.

Any WordPress installation running the Booking Calendar plugin version 10.11.1 or earlier is vulnerable. The affected product is supplied by wpdevelop and is the Booking Calendar WordPress plugin.

The CVSS score of 6.4 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests that, as of the latest data, exploitation is relatively unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker possess at least contributor‑level access to the WordPress site, making the threat primarily internal or on a compromised user account. Once activated, the stored script can affect any user who visits the injected page, creating a widespread impact within the affected site.