PT-2026-78278 · WordPress · Booking Calendar
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37
Description
The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the script-stripping mechanism and executes arbitrary JavaScript when the SVG is opened, which can occur during an administrator's review of a submitted booking.
Recommendations
Update the Booking calendar, Appointment Booking System WordPress plugin to version 3.2.37 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Booking Calendar