Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Booking calendar, Appointment Booking System (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Booking calendar, Appointment Booking System.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 19, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 19, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 19, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token BypassAlso CWE-79
• Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment TitleAlso CWE-79
• EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post ContentAlso CWE-79
• WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterAlso CWE-79
• NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth CallbackAlso CWE-79
• Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File DescriptionAlso CWE-79