Simply Schedule Appointments CVE-2026-39447

Exploitation requires (1) the target WordPress site to have the Simply Schedule Appointments plugin installed at version 1.6.10.6 or earlier with its public-facing booking endpoints reachable from the internet, and (2) a victim user - ideally an authenticated administrator for maximum impact - to be induced into clicking an attacker-crafted link or loading an attacker-controlled page that triggers the XSS sink (CVSS UI:R confirms user interaction is mandatory). No authentication is required of the attacker (PR:N), but the impact is bounded by what the victim's browser session can do, so a victim with only anonymous browsing access yields limited gain compared to luring an administrator. Sites that block plugin endpoints behind IP allowlists, enforce strict CSPs, or do not expose the booking form publicly substantially limit realistic exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) yields 7.1 (High) - exploitation is network-based, low-complexity, requires no authentication, but does require user interaction (typically clicking a crafted link or visiting an attacker-influenced page), with a scope change reflecting that injected script runs in the victim's browser context distinct from the vulnerable component. Real-world risk is meaningful because the plugin is unauthenticated-reachable and Patchstack-reported plugin XSS issues frequently see opportunistic mass scanning, but the UI:R requirement and limited C/I/A impact (L/L/L) keep this below critical priority. No EPSS score, KEV listing, SSVC decision, or POC availability was provided in the input, so exploitability prediction is bounded by the CVSS signal alone; absence of EPSS/KEV data should not be read as confirmation of low likelihood.

An attacker crafts a URL or booking-form interaction containing a malicious JavaScript payload targeting a vulnerable Simply Schedule Appointments endpoint on a WordPress site, then social-engineers a site administrator or logged-in user - for example via a phishing email or a comment link - into visiting it. When the victim loads the page, the injected script executes in the site's origin and can exfiltrate the WordPress session cookie, perform CSRF-protected actions as the victim, or pivot to drop a malicious admin user. No public exploit identified at time of analysis, but reflected XSS in WordPress plugins is routinely weaponized shortly after disclosure.