CVE-2026-14334: Booking Calendar WordPress Plugin XSS Flaw

CVE-2026-14334 Overview

CVE-2026-14334 is a stored cross-site scripting (XSS) vulnerability in the Booking Calendar, Appointment Booking System WordPress plugin through version 3.2.36. The plugin fails to properly sanitize uploaded Scalable Vector Graphics (SVG) files. Unauthenticated attackers can upload a crafted SVG that bypasses the plugin's script-stripping logic. When an administrator opens the submitted booking to review it, the SVG executes arbitrary JavaScript in the administrator's session. This vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute JavaScript in an administrator's authenticated session, enabling account takeover of WordPress sites running the vulnerable plugin.

Affected Products

Booking Calendar, Appointment Booking System WordPress plugin
All versions through 3.2.36
WordPress sites accepting bookings from unauthenticated visitors

Discovery Timeline

2026-08-19 - CVE-2026-14334 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-14334

Vulnerability Analysis

The Booking Calendar, Appointment Booking System plugin allows unauthenticated users to submit bookings that include file attachments. The plugin accepts SVG files and attempts to remove executable script content before storing them. The sanitization routine does not fully strip all JavaScript execution vectors permitted by the SVG specification. Attackers can craft SVG payloads using event handlers, namespaced elements, or CDATA constructs that survive filtering.

When an administrator later opens the booking submission in the WordPress backend, the browser renders the SVG. The embedded JavaScript then executes in the origin of the WordPress site, running with the administrator's active session cookies. This provides full control over the WordPress installation.

Root Cause

The root cause is incomplete input sanitization of user-supplied SVG files [CWE-79]. SVG is an XML-based image format that supports scripting through <script> tags, event attributes such as onload and onclick, and JavaScript URIs in href attributes. The plugin's stripping logic addresses only a subset of these vectors, leaving several bypasses available.

Attack Vector

The attack requires no authentication. An attacker submits a booking through the public-facing form and attaches a malicious SVG file. The plugin stores the file after applying its incomplete sanitizer. An administrator triggers the payload by clicking to review the booking or previewing the uploaded attachment. Because the SVG is served from the WordPress site's own domain, the JavaScript runs same-origin and can create administrator accounts, install plugins, or exfiltrate data.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-14334

Indicators of Compromise

SVG files stored in WordPress wp-content/uploads/ directories containing <script>, onload=, onerror=, or javascript: strings
Unexpected administrator or editor accounts created without a corresponding audit log entry
Booking submissions from anonymous users containing .svg attachments with embedded XML script constructs
Outbound HTTP requests from administrator browser sessions to attacker-controlled domains shortly after reviewing bookings

Detection Strategies

Scan the WordPress uploads directory for SVG files containing script tags, event handler attributes, or javascript: URIs.
Review WordPress audit logs for new user creation, role changes, or plugin installations following administrator interaction with booking submissions.
Inspect web server access logs for POST requests to the plugin's booking submission endpoint that include multipart file uploads with Content-Type: image/svg+xml.

Monitoring Recommendations

Alert on any SVG upload to WordPress sites running the vulnerable plugin until patched.
Monitor administrator session activity for anomalous API calls to /wp-admin/user-new.php or /wp-admin/plugin-install.php immediately after opening booking records.
Deploy a Web Application Firewall (WAF) rule to block SVG uploads on booking submission endpoints.

How to Mitigate CVE-2026-14334

Immediate Actions Required

Deactivate the Booking Calendar, Appointment Booking System plugin until a patched release is installed.
Audit the wp-content/uploads/ directory and remove any suspicious SVG files submitted through the booking form.
Rotate WordPress administrator credentials and invalidate active sessions if any administrator has reviewed bookings with SVG attachments.
Review the WordPress user table for unauthorized accounts and remove any that were not provisioned by the site owner.

Patch Information

No fixed version is listed in the enriched CVE data at the time of publication. The advisory indicates the vulnerability is present in all versions through 3.2.36. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for updates and apply the vendor patch as soon as it is released.

Workarounds

Disable SVG uploads on the booking form or restrict allowed file types to raster image formats such as PNG and JPEG.
Configure the web server to serve SVG uploads with Content-Disposition: attachment so browsers download rather than render them.
Apply a WAF rule that inspects multipart uploads and rejects requests containing image/svg+xml payloads with <script> or event handler attributes.
Restrict access to the WordPress admin booking review pages via IP allowlist until a patch is available.

bash

# Example nginx configuration to force SVG downloads instead of inline rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "script-src 'none'; object-src 'none'";
    types { image/svg+xml svg; }
}