The Booking calendar, Appointment Booking System WordPress plugin through version 3.2.36 contains a CWE-79 Cross-Site Scripting vulnerability due to improper sanitization of uploaded SVG files. This flaw allows unauthenticated attackers to upload SVG files that evade the plugin's script-stripping mechanisms and execute arbitrary JavaScript code when viewed by an administrator. This can lead to session hijacking or other script-based attacks within the administrator's session.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator's session when the malicious SVG file is reviewed. This could lead to session compromise or unauthorized actions performed with administrator privileges. The vulnerability affects the confidentiality and integrity of the administrator's session and potentially the entire WordPress site managed via the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict SVG file uploads or disable the upload feature if possible. Administrators should be cautious when reviewing uploaded SVG files and consider additional security controls such as Content Security Policy (CSP) to mitigate script execution risks.