What the vulnerability does
01Description
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.
Explanation of Vulnerability in Simple Terms
02Summary
Booking Calendar Contact Form versions up to 1.0.23 contain a cross-site scripting (XSS) vulnerability. An authenticated user can inject malicious scripts that execute in other users' browsers when they interact with the form. The vulnerability requires user interaction to trigger. Update to a version newer than 1.0.23.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view or interact with the form.
Potential impact on your site
04Site Impact
Authenticated users could steal session tokens, deface forms, or redirect visitors to malicious sites.
Conditions required to exploit
05Prerequisites
Attacker must have low-level authentication access; victim must click a link or visit a page containing the payload.
Key dates
06Disclosure timeline
June 15, 2026
CVE published
June 15, 2026
Record updated
