EUVD-2026-39730
GHSA-x46x-px7q-p9j7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS reachable over the network (AV:N, AC:L, PR:N) but needs victim interaction (UI:R); injected script crosses into browser context (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.
AnalysisAI
Cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions <= 1.6.12.2) lets unauthenticated remote attackers inject script that executes in a victim's browser when they load a crafted page or follow a crafted link. The CVSS:3.1 vector (PR:N, UI:R, S:C) confirms no authentication is required but a user must interact, and the Changed scope reflects script crossing the security boundary into the visitor's browser context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported through Patchstack's vulnerability research program.
Technical ContextAI
The affected component is Simply Schedule Appointments, a WordPress appointment-booking plugin that exposes booking forms and scheduling interfaces on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is rendered into HTML output without adequate output encoding or input sanitization. Because the flaw is unauthenticated (PR:N) with a CVSS scope of Changed, it behaves as a reflected/DOM-style XSS where attacker-supplied data is echoed into a response and runs under the origin of the WordPress site, crossing into the trust context of whoever loads the affected page. No CPE strings were supplied in the intelligence, so the affected configuration is bounded only by the stated plugin version range.
RemediationAI
Upgrade the Simply Schedule Appointments plugin to the first release published after 1.6.12.2; no exact fixed version number was included in the provided data, so confirm the patched version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-2-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin changelog before deploying. If immediate update is not possible, place the site behind a WAF or Patchstack vPatch rule that filters XSS payloads on the plugin's booking endpoints, and consider temporarily disabling public booking pages (trade-off: this breaks customer self-service scheduling). Because exploitation requires a victim to load attacker-controlled content, also enforce a restrictive Content-Security-Policy to constrain inline script execution (trade-off: CSP can break legitimate inline scripts and needs tuning) and have administrators avoid following untrusted links into the WordPress admin while logged in.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today