CVE-2025-64381

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored XSS.This issue affects Booking Calendar: from n/a through <= 10.14.7.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-643824.3Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Expl CVE-2025-643836.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored CVE-2025-643845.3Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Sec CVE-2025-643859.2The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s softw CVE-2025-643867.7The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be do CVE-2025-643875.1The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page CVE-2025-643889.2Denial of service of the web server through specific requests to this protocol CVE-2025-643898.3The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.CVE-2025-64399.8The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to CVE-2025-643907.4A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can CVE-2025-643914.1This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locati CVE-2025-643924.8This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craft