Easy Appointments EUVD-2026-72648

Exploitation requires that the target WordPress site has the Easy Appointments plugin installed and active in a version at or below 4.0.2.1. The DOM-based XSS vector requires victim interaction: the attacker must deliver a crafted URL to the target user, who must load it in a browser (UI:R). No attacker authentication is required (PR:N), and no non-default configuration is needed beyond the plugin being present and active. The specific vulnerable DOM sink and source parameter are not identified in available data - the Patchstack advisory should be consulted. Exploitation is limited by the need for victim interaction, ruling out fully automated mass compromise, but does not require any special platform, server configuration, or plugin feature to be separately enabled.

The CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-exploitable flaw requiring no attacker authentication and only victim click interaction, which is a realistic social-engineering threshold for targeted attacks against WordPress site administrators. The scope change (S:C) increases concern because successful exploitation affects the entire WordPress page context, not just the plugin component. No EPSS data was provided and no KEV listing exists, so widespread automated exploitation is not confirmed; however, the attack pattern (craft link, deliver to admin, hijack session) is well understood and requires no specialized tooling. Even a small municipal or commercial operator should prioritize patching given that admin-targeted XSS in WordPress plugins is a documented and commonly exploited attack class. The A:L availability metric in the provided CVSS vector is difficult to reconcile with standard DOM XSS behavior and may be overstated - availability impact is assessed as negligible absent a defacement or resource-exhaustion component in the specific sink. Real-world risk is moderate, gated primarily by the need for victim interaction.

An attacker crafts a URL targeting the vulnerable Easy Appointments page with a JavaScript payload embedded in a DOM-processed parameter (such as a query string or fragment identifier) and delivers it to a WordPress administrator via phishing email or a malicious link. When the administrator loads the URL, the plugin's client-side JavaScript writes the unvalidated input into the DOM, executing the attacker's script in the administrator's browser and potentially exfiltrating the WordPress session cookie or silently creating a backdoor admin account. No public proof-of-concept has been identified, but the attack technique is standard and well-documented for DOM XSS vulnerabilities.