CVE-2026-14334: Unknown Booking Calendar, Appointment Booking System

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.

Affected products

• Unknown Booking Calendar, Appointment Booking System: from 3.2.18, up to and including 3.2.36

Published 2026-08-19. Last modified 2026-08-26.