Simply Schedule Appointments CVE-2026-104000

The 'status' parameter accepts attacker input without sanitization, and the payload is stored unconditionally because debug logging is enabled by DEFAULT - so no special attacker configuration is needed to plant the script. Execution, however, is gated: the injected JavaScript only runs when someone opens the plugin's debug-log viewer, which is reachable by anyone possessing the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT shown in wp-admin), and realistically fires against an administrator or support agent performing troubleshooting. Limiting factors for defenders: the payload does not auto-execute against arbitrary visitors - it requires a privileged user to access the debug-log viewer, so sites that rarely use the debug log or that restrict/rotate the Support PIN face reduced practical risk. Affected deployments are WordPress installations running Simply Schedule Appointments version 1.6.12.35 or earlier.

Signals are moderately concerning but do not indicate an urgent, widespread threat. The CVSS 3.1 base score of 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C reflects an unauthenticated, network-reachable injection point with a changed scope, because the stored payload ultimately executes in the context of a privileged administrator session rather than the attacker's own. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code is referenced, so this is currently 'no public exploit identified at time of analysis' and not confirmed active exploitation. A key internal tension must be flagged: the official vector asserts UI:N, but the description explicitly states the script fires only 'whenever a user accesses an injected page' - i.e., when an administrator opens the debug-log viewer during support/troubleshooting - which is user interaction in practice; verify UI metric with Wordfence. The impact is also rated C:L/I:L/A:N (limited), consistent with reflected session-context script execution rather than full takeover, though XSS firing against an admin session can be chained toward account/site compromise. Net: a legitimate High-severity stored XSS worth patching promptly on affected WordPress sites, but absent KEV, EPSS, and POC data it reads as a credible-but-not-emergency issue rather than a mass-exploited priority.

An unauthenticated attacker submits a crafted value in the 'status' parameter to the Simply Schedule Appointments plugin, which is stored unconditionally in the plugin debug log because debug logging is enabled by default. When an administrator or support agent later opens the debug-log viewer (accessible to anyone holding the site-wide Support PIN) during ordinary troubleshooting, the injected JavaScript executes in the admin's authenticated browser session. No public exploit code is referenced, but the injection path and default-on logging make it straightforwardly reproducible.