The Booking Calendar WordPress plugin contains a stored XSS flaw that permits authenticated users with Administrator‑level privileges to inject arbitrary JavaScript into the plugin’s settings. When a vulnerable page is loaded, the injected script runs in the context of any user who visits that page, providing an attacker with the possibility of session hijacking, credential theft, or defacement. This vulnerability resides in the input handling of the booking settings interface.

The flaw affects all versions of the Booking Calendar plugin by wpdevelop up to and including 10.14.1. Site owners running any of those releases on WordPress require remediation.

The CVSS base score is 6.4, indicating a medium‑to‑high risk. The EPSS score of less than 1 % indicates that the probability of exploitation in the wild is low. Because the flaw requires authenticated access, the attack vector is limited to users who can log in with Administrator or higher level roles. Even though the vulnerability is not listed in the CISA KEV catalog, it remains a significant threat to sites that rely on this plugin because of its potential to impact many visitors.