Easy Appointments
CVE-2017-15812
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
AnalysisAI
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. Affected products include: Easy-Appointments Easy Appointments. Version information: before 1.12.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Easy Appointments
View allalextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrati
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authentic
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any au
Una
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level W
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level au
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote atta
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthent
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today