Unknown Booking Calendar, Appointment Booking System vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Booking Calendar, Appointment Booking System, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2022-3982unknownbooking calendar, appointment booking system+2
EPSS score
4.81%
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE8.8CVE-2026-14334unknownbooking calendar, appointment booking system+1
EPSS score
0.54%
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.