What is the CVSS score of CVE-2026-65513?

CVE-2026-65513 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Simply Schedule Appointments are affected by CVE-2026-65513?

The Simply Schedule Appointments WordPress plugin (versions ≤1.6.12.10) contains an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious scripts into…

How to fix or mitigate CVE-2026-65513?

Within 24 hours: Inventory all WordPress installations using Simply Schedule Appointments plugin versions 1.6.12.10 or earlier and disable the plugin immediately to block attack vectors. Within 7 days: Contact the plugin vendor for patch timeline and evaluate alternative appointment scheduling solutions; if alternatives are not viable, implement Web Application Firewall rules to block XSS payloads targeting the plugin's vulnerable endpoints. Within 30 days: Complete migration to patched or replacement plugin, and conduct security audit of WordPress instances to confirm no malicious scripts were injected during exposure window.

Simply Schedule Appointments CVE-2026-65513

EUVD-2026-53966 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-wh7j-9mm7-vj2x

WordPress XSS Simply Schedule Appointments Wordpress Plugin Nsquared

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-exploitable unauthenticated XSS with scope change; A:N because XSS does not typically impair availability of the vulnerable system itself.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:27 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

AnalysisAI

Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.

Technical ContextAI

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-supplied input is reflected or stored in HTML output without adequate sanitization or encoding. The affected product is the 'Simply Schedule Appointments' plugin by nsquared for WordPress, identified via CPE cpe:2.3:a:nsquared:simply_schedule_appointments:*:*:*:*:*:*:*:*. As a scheduling plugin, it likely processes user-submitted form fields such as names, contact details, or appointment notes, any of which could be the unsanitized injection vector. The S:C (Scope Changed) metric in the CVSS vector confirms that the injected payload escapes the vulnerable component's security boundary and executes within the victim's browser, the classic XSS scope-change pattern.

RemediationAI

The primary remediation is to upgrade the Simply Schedule Appointments plugin beyond version 1.6.12.10. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-10-cross-site-scripting-xss-vulnerability provides the authoritative fix guidance; an exact patched version number was not specified in the available intelligence and should be confirmed via the WordPress plugin repository or the Patchstack page before upgrading. As a compensating control if immediate patching is not possible, deploying a Web Application Firewall (WAF) rule targeting reflected XSS patterns on the plugin's endpoints can reduce exposure, though WAF rules for stored XSS are less reliable. Enforcing a strict Content-Security-Policy header on the WordPress installation to block inline script execution would neutralize the impact of a successful injection. Restricting plugin access to trusted network segments is not a practical control for appointment-booking plugins that serve public users.