Simply Schedule Appointments CVE-2026-65513

The attacker requires no authentication (PR:N per CVSS vector) and no special system privileges. Exploitation requires that a victim - most damagingly an authenticated WordPress administrator - loads a page or follows a link containing the injected payload (UI:R per CVSS vector). The Simply Schedule Appointments plugin must be installed and active on the target WordPress site. Sites with a Content-Security-Policy that blocks inline scripts or unsafe-eval are substantially protected even if the payload is injected. No non-default configuration is required for the plugin to be vulnerable; the flaw affects the default installed state of versions up to 1.6.12.10.

The NVD CVSS 3.1 score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a meaningful but not critical risk. The unauthenticated attack vector (PR:N) and low complexity (AC:L) mean any internet-accessible WordPress site running this plugin could be targeted without credentials. The required user interaction (UI:R) is the primary mitigating factor - a victim must load a crafted page or click a crafted link. No EPSS data was provided in the source intelligence, and no CISA KEV listing exists, so widespread automated exploitation has not been confirmed. However, unauthenticated XSS in WordPress plugins is a well-understood attack class that is frequently exploited for admin account takeover via session cookie theft. The A:L metric in the provided CVSS vector is unusual for pure XSS and may reflect the plugin's ability to disrupt appointment-booking functionality; this metric is not independently confirmed from the description. Real-world risk is elevated for sites where authenticated admins are active users, but is lower for sites with stringent Content Security Policy headers.

An attacker identifies a WordPress site running Simply Schedule Appointments <= 1.6.12.10, crafts a URL or form submission containing a JavaScript payload in an unsanitized input field (such as a name or notes field), and distributes the link to a site administrator via phishing or embeds it in a publicly visible page. When the authenticated administrator loads the malicious content in their browser, the injected script executes in the WordPress admin context, exfiltrating the session cookie or performing privileged actions such as creating a rogue admin account. No public exploit code has been identified at time of analysis, but the technique is standard and requires no specialized tooling.