EUVD-2026-39730
GHSA-x46x-px7q-p9j7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS reachable over the network (AV:N, AC:L, PR:N) but needs victim interaction (UI:R); injected script crosses into browser context (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.
AnalysisAI
Cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions <= 1.6.12.2) lets unauthenticated remote attackers inject script that executes in a victim's browser when they load a crafted page or follow a crafted link. The CVSS:3.1 vector (PR:N, UI:R, S:C) confirms no authentication is required but a user must interact, and the Changed scope reflects script crossing the security boundary into the visitor's browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Simply Schedule Appointments plugin (<= 1.6.12.2) to be installed and the affected booking/scheduling page reachable by the attacker; no authentication is needed (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate and broadly consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a link or booking request containing a malicious script payload and lures a site visitor or logged-in administrator into loading it; because the input is reflected without sanitization, the script executes in their browser under the site's origin. With low attack complexity and no authentication needed, the attacker can steal session cookies, perform actions as the victim, or pivot toward admin account takeover. … |
| Remediation | Upgrade the Simply Schedule Appointments plugin to the first release published after 1.6.12.2; no exact fixed version number was included in the provided data, so confirm the patched version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-2-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable Simply Schedule Appointments plugin immediately and verify removal in WordPress admin; review web server and WAF logs for XSS exploitation patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today