Description

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T06:17:33.263Z",
  "pubdate": "2026-08-19T06:17:33.263Z",
  "executiveSummary": "The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 suffers from an arbitrary JavaScript execution vulnerability stemming from improper input sanitization of uploaded SVG files. The flaw allows unauthenticated malicious actors to upload crafted Scalable Vector Graphics files that successfully bypass the application's built-in script-stripping mechanisms. When an unsuspecting user, particularly an authenticated administrator reviewing submitted bookings, opens or views the malicious SVG file within their browser session, the embedded arbitrary JavaScript executes in the context of their active session. This Stored Cross-Site Scripting (XSS) condition introduces severe risk implications, potentially leading to administrative account compromise, unauthorized manipulation of booking data, and complete integrity loss of the affected WordPress site. Successful exploitation requires network access to the target WordPress instance and the ability to submit booking requests containing file uploads, without requiring prior authentication or privileged access.",
  "technicalDetails": "The vulnerability resides within the file upload and processing component of the Booking calendar, Appointment Booking System WordPress plugin across all versions up to and including 3.2.36. The root cause of the security defect is the failure of the plugin's file handling logic to adequately sanitize and neutralize executable content embedded within Scalable Vector Graphics (SVG) file uploads.\nSVGs are XML-based vector image formats that natively support embedded scripting languages such as ECMAScript/JavaScript via elements like <script> or event handlers (e.g., onload). While the application attempts to enforce script-stripping defenses against uploaded files, the implemented filters fail to comprehensively parse and neutralize maliciously crafted SVG structures, allowing script tags and active content to bypass inspection.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious SVG payload containing arbitrary JavaScript designed to execute upon rendering. Second, the attacker leverages the booking submission mechanism exposed by the Booking calendar, Appointment Booking System plugin to upload the payload file. Third, because the validation routines inadequately sanitize the SVG structure, the file is successfully stored on the server.\nFinally, when a privileged user, such as a site administrator, accesses the plugin's booking management interface to review submitted bookings, the browser renders the uploaded SVG file. The embedded JavaScript executes within the Document Object Model (DOM) under the security context of the administrator's active session. This grants the payload access to session cookies, sensitive DOM elements, and administrative functionality, enabling post-exploitation actions such as the creation of arbitrary administrative accounts, installation of malicious plugins, or redirection of users."
}