Unsanitized SVG Upload Enables XSS in WordPress Booking Plugin

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Booking calendar, Appointment Booking System WordPress plugin fails to properly sanitize SVG file uploads, allowing unauthenticated attackers to execute arbitrary JavaScript in the browsers of users who view the uploaded files—particularly administrators reviewing bookings. This vulnerability matters because WordPress plugins extend core functionality across millions of websites, and appointment booking systems are trusted to handle customer interactions and sensitive data. Anyone running the affected plugin versions (through 3.2.36) is at risk, as the attack requires no authentication and can compromise administrative sessions where attackers gain visibility into bookings, customer information, and potentially the site's backend.

Casky.ai's 322 matched skills detect the attack patterns mapped to TA0001 (Initial Access—file upload exploitation) and TA0043 (Reconnaissance—script injection preparation). Practitioners using Claude AI's extended reasoning across these mapped skills would identify suspicious patterns including: SVG files uploaded through booking forms with embedded script tags or event handlers that bypass sanitization filters, JavaScript execution triggered when files are rendered in admin dashboards, and XSS payloads designed to harvest session tokens or administrative credentials. The platform's security skills would flag the gap between expected SVG validation (removal of executable content) and actual behavior (script persistence), enabling teams to detect both active exploitation attempts in file upload logs and archived malicious SVG content before it reaches administrators.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14334.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-14334

Casky has 322 skills that investigate the attack patterns behind CVE-2026-14334. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn