CVE-2025-64275
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Booking Manager plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Manager versions from n/a through <= 2.1.17.
Risk Assessment
An attacker can inject a malicious script that is stored and executed in the user's browser, potentially leading to session theft, redirects, or other actions in the victim's context. The risk is real if a user visits an infected page.
Recommendation
Update the Booking Manager plugin to a version newer than 2.1.17 as soon as it becomes available. Additionally, enforce input validation and educate users on safe browsing.
Other vulnerabilities in Booking Manager
See all- CVE-2026-91025Medium
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access and above can create or overwrite the plugin's per-user settings on arbitrary users, including administrators.
- CVE-2026-91024Medium
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access and above can perform SQL injection attacks by importing a feed they control.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS