CVE-2026-14334 WordPress CVE debrief

Who should care

Administrators and users of the Booking calendar, Appointment Booking System WordPress plugin, as well as security teams monitoring for potential JavaScript execution vulnerabilities, should review and update to version 3.2.37 or later to address this vulnerability. Additionally, security teams should monitor for suspicious SVG file uploads and JavaScript execution, and implement additional security controls, such as validating and sanitizing user-uploaded files.

Technical summary

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the plugin's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking. This vulnerability has a CVSS score of 8.8 and is considered HIGH severity.

Defensive priority

Administrators and users of the Booking calendar, Appointment Booking System WordPress plugin should review and update to version 3.2.37 or later to address this vulnerability.

Recommended defensive actions

• Review and update the Booking calendar, Appointment Booking System WordPress plugin to version 3.2.37 or later.
• Monitor for suspicious SVG file uploads and JavaScript execution.
• Implement additional security controls, such as validating and sanitizing user-uploaded files.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence is based on limited information from the NVD and a third-party source (WPScan). Further verification is recommended. The CVE record was published on 2026-08-19T06:17:33.263Z and has not been modified since then. The NVD entry is currently Deferred. Defenders should verify affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.