Booking calendar, Appointment Booking System, CVE-2026-14334

CVE, Research URL: CVE-2026-14334
Home page URL: Security reports for Booking calendar, Appointment Booking System
Application: Booking calendar, Appointment Booking System
Published on: Aug 19, 2026
Research Description: The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.
Affected versions: max 3.2.36.
Status: vulnerable