CVE-2025-4669 is a stored cross-site scripting vulnerability in the WP Booking Calendar plugin for WordPress, affecting all versions up to and including 10.11.1. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically in the wpbc shortcode, allowing authenticated users with contributor-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the wpbc shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no direct availability impact. The vulnerability does not require user interaction beyond viewing the injected page.

No official patch or fix has been confirmed or linked by the vendor as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the wpbc shortcode. Monitor vendor communications for updates and apply patches promptly once released.