Easy Appointments
Monthly
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Una
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote attackers to access protected appointment data without authentication due to missing authorization checks. Patchstack reports the issue as a broken access control flaw with high confidentiality impact (CVSS 7.5); no public exploit identified at time of analysis, and the plugin is not currently listed in CISA KEV.
Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrative actions including admin account creation, credential modification, and full account takeover by tricking authenticated administrators into visiting a malicious page. The vulnerability stems from incomplete CSRF protection that only validates POST requests while state-changing operations accept GET parameters. A publicly available exploit exists (GitHub Security Advisory GHSA-54v4-4685-vwrj), though EPSS exploitation probability is low (0.01%, 1st percentile) and the vulnerability is not listed in CISA KEV, suggesting limited real-world exploitation to date.
Any authenticated WordPress user holding contributor-level capabilities or higher can pull the entire customer dataset out of the Easy Appointments plugin (all versions up to and including 3.12.27) because the handle_customers_ajax handler returns ea_customers records without enforcing an adequate capability check. The exposed records contain personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses, so the impact is a high-confidentiality, read-only disclosure with no integrity or availability effect, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N score of 6.5 (MEDIUM). Exploitation is not possible for unauthenticated visitors - an attacker must first hold a low-privilege account - and no public exploit identified at time of analysis; risk is concentrated on multi-author sites, membership sites, or any installation that hands out contributor accounts or has self-registration mapped to elevated default roles.
Unauthenticated attackers can overwrite arbitrary appointment records in the Easy Appointments WordPress plugin (versions 4.0 through 4.0.2.2) by sending a request-supplied appointment id to the plugin's public appointment-reservation endpoint, which performs no ownership or authorization check before updating the record. The same missing check lets a follow-on cleanup routine delete the targeted appointments, so booking data on affected sites can be corrupted or removed. Publicly available exploit code exists, but there is no indication of confirmed active exploitation (the CVE is not in CISA KEV), and the impact is bounded - integrity and some availability of appointment records only, with no confidentiality loss and no code execution, which is why the risk is real but moderate rather than critical.
Unauthenticated attackers can cancel or confirm arbitrary appointments in the Easy Appointments WordPress plugin before 4.0.2.2 because the mail-link action token is derived from a hardcoded, source-embedded salt combined with the appointment's creation timestamp instead of an unguessable secret. Exploitation hinges on knowing or guessing the target appointment timestamp, which keeps reliability limited (reflected as AC:H in CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, base 4.8); impact is confined to integrity and availability of existing appointment records with no data disclosure. Publicly available exploit code exists, and a vendor-released patch (4.0.2.2) is available.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.
Authorization bypass in the Easy Appointments WordPress plugin (all versions up to and including 3.12.27) permits any authenticated user holding the Author role or above to mass-cancel every future appointment across the entire site by exploiting a missing capability check on the plugin's AJAX cancellation handler. The attack is made trivially accessible because the nonce required to authenticate the cancellation request is rendered directly on the Appointments admin page, which is gated only by the `edit_posts` capability that Authors possess by default. No public exploit has been identified at time of analysis, but the low privilege barrier and deterministic exploit path present a high-consequence business-disruption risk for any organization running booking workflows on affected installations.
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments allows Cross Site Request Forgery.4.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Una
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote attackers to access protected appointment data without authentication due to missing authorization checks. Patchstack reports the issue as a broken access control flaw with high confidentiality impact (CVSS 7.5); no public exploit identified at time of analysis, and the plugin is not currently listed in CISA KEV.
Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrative actions including admin account creation, credential modification, and full account takeover by tricking authenticated administrators into visiting a malicious page. The vulnerability stems from incomplete CSRF protection that only validates POST requests while state-changing operations accept GET parameters. A publicly available exploit exists (GitHub Security Advisory GHSA-54v4-4685-vwrj), though EPSS exploitation probability is low (0.01%, 1st percentile) and the vulnerability is not listed in CISA KEV, suggesting limited real-world exploitation to date.
Any authenticated WordPress user holding contributor-level capabilities or higher can pull the entire customer dataset out of the Easy Appointments plugin (all versions up to and including 3.12.27) because the handle_customers_ajax handler returns ea_customers records without enforcing an adequate capability check. The exposed records contain personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses, so the impact is a high-confidentiality, read-only disclosure with no integrity or availability effect, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N score of 6.5 (MEDIUM). Exploitation is not possible for unauthenticated visitors - an attacker must first hold a low-privilege account - and no public exploit identified at time of analysis; risk is concentrated on multi-author sites, membership sites, or any installation that hands out contributor accounts or has self-registration mapped to elevated default roles.
Unauthenticated attackers can overwrite arbitrary appointment records in the Easy Appointments WordPress plugin (versions 4.0 through 4.0.2.2) by sending a request-supplied appointment id to the plugin's public appointment-reservation endpoint, which performs no ownership or authorization check before updating the record. The same missing check lets a follow-on cleanup routine delete the targeted appointments, so booking data on affected sites can be corrupted or removed. Publicly available exploit code exists, but there is no indication of confirmed active exploitation (the CVE is not in CISA KEV), and the impact is bounded - integrity and some availability of appointment records only, with no confidentiality loss and no code execution, which is why the risk is real but moderate rather than critical.
Unauthenticated attackers can cancel or confirm arbitrary appointments in the Easy Appointments WordPress plugin before 4.0.2.2 because the mail-link action token is derived from a hardcoded, source-embedded salt combined with the appointment's creation timestamp instead of an unguessable secret. Exploitation hinges on knowing or guessing the target appointment timestamp, which keeps reliability limited (reflected as AC:H in CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, base 4.8); impact is confined to integrity and availability of existing appointment records with no data disclosure. Publicly available exploit code exists, and a vendor-released patch (4.0.2.2) is available.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.
Authorization bypass in the Easy Appointments WordPress plugin (all versions up to and including 3.12.27) permits any authenticated user holding the Author role or above to mass-cancel every future appointment across the entire site by exploiting a missing capability check on the plugin's AJAX cancellation handler. The attack is made trivially accessible because the nonce required to authenticate the cancellation request is rendered directly on the Appointments admin page, which is gated only by the `edit_posts` capability that Authors possess by default. No public exploit has been identified at time of analysis, but the low privilege barrier and deterministic exploit path present a high-consequence business-disruption risk for any organization running booking workflows on affected installations.
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments allows Cross Site Request Forgery.4.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.