CVE-2025-23653 describes a reflected Cross-site Scripting vulnerability in the Nabeel Tahir Form To Online Booking plugin (cf7-calendly-integration) versions up to 1.0. The vulnerability is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute in users' browsers when they interact with the affected form. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The impact includes partial loss of confidentiality, integrity, and availability. There is no vendor advisory or patch link provided, and no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity with potential partial impact on all three security properties. However, no known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is available at this time, users should monitor for updates from the vendor. As a temporary mitigation, users may consider disabling or removing the affected plugin until a fix is released. Avoid clicking on suspicious links that interact with the vulnerable form to reduce risk of exploitation.