EUVD-2026-72648
GHSA-rf52-23w5-wr23
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
DOM XSS is network-exploitable without authentication (AV:N/PR:N), requires victim link-click (UI:R), crosses scope (S:C); no direct availability impact, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS.
This issue affects Easy Appointments: from n/a through 4.0.2.1.
Articles & Coverage 2
AnalysisAI
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Easy Appointments plugin installed and active in a version at or below 4.0.2.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-exploitable flaw requiring no attacker authentication and only victim click interaction, which is a realistic social-engineering threshold for targeted attacks against WordPress site administrators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Easy Appointments plugin to a version beyond 4.0.2.1 as soon as the patched release is available - the specific fixed version is not confirmed from current data, so consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-4-0-2-1-cross-site-scripting-xss-vulnerability and the WordPress plugin repository for the latest release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress sites to identify those running Easy Appointments plugin version 4.0.2.1 or earlier and flag which are internet-facing; review server and application logs for suspicious requests or script injection patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Easy Appointments
View allalextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrati
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authentic
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any au
Una
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level W
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level au
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote atta
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authe
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today