CVE-2026-14334CWE-79cross-site-scripting

CVE-2026-14334

High · published August 19, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00536 · 44.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-19T10:17Z
References (1)
https://wpscan.com/vulnerability/9ddd1628-0b06-461b-8a5f-ba977f83fa7f/ · [email protected]
EPSS history
Timeline
  • 19 AUG 06:00Z
    Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
    cvelistv5