CVE-2022-3982criticalobserved exploitation

CVE-2022-3982: critical vulnerability in Booking calendar, Appointment Booking System

Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor Booking calendar, Appointment Booking System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 4.8%
from disclosure to weapon
Published on NVDDec 12
VulnCheck+376d
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Booking calendar, Appointment Booking System
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Booking calendar, Appointment Booking System

In the same product, most dangerous first.

CVE-2026-14334HIGHBooking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File UploadEPSS 0.5%