Simply Schedule Appointments EUVD-2026-103423

Exploitation requires the site to run Simply Schedule Appointments version n/a through 1.6.12.35 with a user-reachable input (such as the public appointment-booking form) whose data is rendered unsanitized in a privileged view. The key LIMITING factor is UI:R: the stored payload only triggers when a staff member or administrator subsequently opens the attacker-controlled booking in the WordPress admin dashboard, so there is no self-contained automatic execution. Impact is bounded to the victim's browser/session context (Low C/I/A). No special non-default configuration is indicated beyond having the plugin active with booking intake enabled.

This is a Patchstack-reported Stored Cross-Site Scripting (CWE-79) flaw in the Simply Schedule Appointments WordPress plugin, carrying a vendor CVSS 3.1 score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector signals a network-reachable, low-complexity issue requiring no attacker privileges (PR:N) but requiring victim interaction (UI:R), with a changed scope (S:C) reflecting that the injected script executes in a different security context (typically a plugin admin/staff user's browser) than where it was stored. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so by precision rules this is 'no public exploit identified at time of analysis.' Signals are internally consistent - a public-facing appointment plugin plausibly lets an unauthenticated booker inject a payload (supporting PR:N) that fires when staff review the entry (supporting UI:R and S:C). Net assessment: a genuine but moderate-priority issue - Low-impact across C/I/A and dependent on an administrator viewing attacker-controlled content, rather than a wormable, unauthenticated-RCE emergency. The absence of KEV/EPSS/POC data means this reflects pre-exploitation risk; low real-world urgency should not be mistaken for safety, since stored XSS in admin contexts can escalate to session/account takeover.

An attacker submits a public appointment-booking form on a WordPress site running Simply Schedule Appointments (≤1.6.12.35), placing a malicious script into a field (e.g., name or notes) that the plugin fails to sanitize. The payload is stored and later executes in the browser of a staff member or administrator who opens the booking in the WordPress dashboard, running in their authenticated session. No public exploit code is identified at the time of analysis, but exploitation is low-complexity and the stored, deferred-trigger nature makes it reliable once an admin views the entry.