CVE-2025-14383

Name of the Vulnerable Software and Affected Versions Booking Calendar plugin for WordPress versions prior to 10.14.9

Description The Booking Calendar plugin for WordPress is susceptible to a time-based blind SQL injection. This occurs due to insufficient escaping of the dates to check parameter and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is dates to check.

Recommendations Update the Booking Calendar plugin to version 10.14.9 or later.