Simply Schedule Appointments
Monthly
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauthenticated remote attacker to perform arbitrary privileged actions on behalf of a logged-in WordPress administrator. By luring an authenticated admin into loading a malicious web page or clicking a crafted link, the attacker's forged request is executed with the victim's full session privileges - potentially manipulating appointment data, customer records, and plugin configuration. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is reported by Patchstack.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.
Unauthenticated sensitive data exposure in the Simply Schedule Appointments WordPress plugin versions prior to 1.6.11.2 allows remote attackers to retrieve protected information without credentials over the network. The flaw is reported by Patchstack and carries a CVSS 7.5 (high) confidentiality-only impact, with no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote attackers to inject crafted SQL through plugin endpoints without authentication. The flaw carries a CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the vulnerable component, though only confidentiality (High) and availability (Low) are affected per the vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.10.6) allows remote attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link or page. Successful exploitation can lead to session hijacking, credential theft, or administrative actions performed in the context of the targeted user. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Blind SQL injection in NSquared Simply Schedule Appointments WordPress plugin versions ≤1.6.9.27 allows authenticated attackers with low-privilege access to extract sensitive database contents and potentially trigger denial-of-service conditions. The vulnerability stems from improper neutralization of SQL special elements in user-controlled input. Network-accessible exploitation requires valid credentials but no user interaction. CVSS 8.5 severity reflects high confidentiality impact with scope change, enabling cross-boundary data access. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%, 6th percentile).
Authenticated users with low-privileged WordPress accounts can exploit an insecure direct object reference (IDOR) in the Simply Schedule Appointments plugin through version 1.6.12.35 to read and alter appointment and booking records belonging to other users, because the plugin's endpoints accept a user-controlled object key without verifying ownership. The flaw requires valid credentials (CVSS vector PR:L, so it is not pre-auth) and yields only partial confidentiality and integrity impact rather than full site takeover; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a moderate, authenticated-user authorization weakness rather than an emergency. Sites that grant subscriber-level or other low-privilege accounts are the primary exposure surface.
Incorrect authorization in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.11) allows unauthenticated attackers who possess a valid per-appointment booking token to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. The weakness is a business-logic authorization flaw (CWE-863) confined to appointment records: it grants no server access, no data disclosure, and no code execution, which is why it carries a moderate CVSS score of 5.3 (integrity-only, low impact). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though sites that rely on the plugin's payment-confirmation or service-assignment fields (for example, paid bookings) face the greatest practical exposure.
Authenticated WordPress users at subscriber level or above can exploit an insecure direct object reference in the Simply Schedule Appointments plugin (all versions up to and including 1.6.12.31) through the 'complete_group' parameter to harvest every co-booker's private per-appointment id_token (surfaced as public_token) along with their name and email address, then reuse each leaked token to read, overwrite arbitrary appointment metadata, or cancel the victim's booking via the same REST controller. Exploitation is access-gated rather than open to anonymous scans: the attacker must already hold a valid id_token for at least one appointment inside the targeted group booking, and the exposure is confined to co-bookers of that shared booking, so real-world risk scales with how heavily a site relies on group bookings. No public exploit code and no CISA KEV listing were identified at time of analysis, though an independent assessment rates integrity and availability impact higher than the vendor vector (CVSS 3.1 C:H/I:H/A:L versus the published C:H/I:N/A:N), reflecting the token-reuse tampering path.
Unauthenticated attackers can read appointment and booking records from WordPress sites running the Simply Schedule Appointments plugin at version 1.6.12.31 or earlier by manipulating object identifiers passed to the plugin's public-facing endpoints, an insecure direct object reference (IDOR) issue tracked as CVE-2026-94673. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): no credentials, no user interaction, and only low-complexity remote requests are required, but impact is limited to confidentiality - data can be viewed, not altered or deleted. Exploitation is feasible against default configurations wherever the plugin is installed and its AJAX/REST endpoints are reachable; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so real-world urgency is moderate rather than critical, with exposure bounded to the objects the vulnerable endpoint exposes rather than the whole site.
Missing authorization checks in the Simply Schedule Appointments WordPress plugin through version 1.6.12.29 let unauthenticated remote users reach plugin functionality that should require a privileged role, exposing and potentially altering appointment-related data. Because the CVSS vector is PR:N/UI:N with AV:N/AC:L, any internet-facing WordPress installation running an affected version of the plugin needs no credentials, no user role, and no victim interaction to be targeted; the assessed impact is bounded to Low confidentiality and Low integrity loss rather than code execution, privilege escalation, or site takeover. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no vendor-released patch version is identified in the available data, so this is a genuine but moderate-priority issue that should be triaged against the actual presence and reachability of the plugin.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Missing Authorization in NSquared's Simply Schedule Appointments WordPress plugin (versions through 1.6.11.11) allows unauthenticated network attackers to bypass access control security levels, yielding limited confidentiality and integrity impact against affected WordPress sites. Reported by Patchstack under CWE-862, the flaw is automatable per CISA's SSVC framework, meaning it can be exploited at scale without human interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching.
Unauthenticated broken access control in the Simply Schedule Appointments WordPress plugin (versions through 1.6.12.4) allows remote attackers to perform unauthorized actions against appointment data, resulting in low-integrity and low-availability impacts. The plugin by NSquared fails to enforce proper authorization checks on one or more endpoints, enabling exploitation without any credentials against default installations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero privilege requirement lower the barrier for opportunistic abuse.
Missing authorization in NSquared Simply Schedule Appointments WordPress plugin through version 1.6.10.2 allows unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 (low-moderate) and EPSS probability of 0.02%, placing it in the lower-risk percentile despite public awareness. No active exploitation has been confirmed, and SSVC decision data indicates the issue is automatable but non-critical due to partial technical impact.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin.6.6.1. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauthenticated remote attacker to perform arbitrary privileged actions on behalf of a logged-in WordPress administrator. By luring an authenticated admin into loading a malicious web page or clicking a crafted link, the attacker's forged request is executed with the victim's full session privileges - potentially manipulating appointment data, customer records, and plugin configuration. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is reported by Patchstack.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.
Unauthenticated sensitive data exposure in the Simply Schedule Appointments WordPress plugin versions prior to 1.6.11.2 allows remote attackers to retrieve protected information without credentials over the network. The flaw is reported by Patchstack and carries a CVSS 7.5 (high) confidentiality-only impact, with no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote attackers to inject crafted SQL through plugin endpoints without authentication. The flaw carries a CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the vulnerable component, though only confidentiality (High) and availability (Low) are affected per the vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.10.6) allows remote attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link or page. Successful exploitation can lead to session hijacking, credential theft, or administrative actions performed in the context of the targeted user. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Blind SQL injection in NSquared Simply Schedule Appointments WordPress plugin versions ≤1.6.9.27 allows authenticated attackers with low-privilege access to extract sensitive database contents and potentially trigger denial-of-service conditions. The vulnerability stems from improper neutralization of SQL special elements in user-controlled input. Network-accessible exploitation requires valid credentials but no user interaction. CVSS 8.5 severity reflects high confidentiality impact with scope change, enabling cross-boundary data access. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%, 6th percentile).
Authenticated users with low-privileged WordPress accounts can exploit an insecure direct object reference (IDOR) in the Simply Schedule Appointments plugin through version 1.6.12.35 to read and alter appointment and booking records belonging to other users, because the plugin's endpoints accept a user-controlled object key without verifying ownership. The flaw requires valid credentials (CVSS vector PR:L, so it is not pre-auth) and yields only partial confidentiality and integrity impact rather than full site takeover; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a moderate, authenticated-user authorization weakness rather than an emergency. Sites that grant subscriber-level or other low-privilege accounts are the primary exposure surface.
Incorrect authorization in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.11) allows unauthenticated attackers who possess a valid per-appointment booking token to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. The weakness is a business-logic authorization flaw (CWE-863) confined to appointment records: it grants no server access, no data disclosure, and no code execution, which is why it carries a moderate CVSS score of 5.3 (integrity-only, low impact). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though sites that rely on the plugin's payment-confirmation or service-assignment fields (for example, paid bookings) face the greatest practical exposure.
Authenticated WordPress users at subscriber level or above can exploit an insecure direct object reference in the Simply Schedule Appointments plugin (all versions up to and including 1.6.12.31) through the 'complete_group' parameter to harvest every co-booker's private per-appointment id_token (surfaced as public_token) along with their name and email address, then reuse each leaked token to read, overwrite arbitrary appointment metadata, or cancel the victim's booking via the same REST controller. Exploitation is access-gated rather than open to anonymous scans: the attacker must already hold a valid id_token for at least one appointment inside the targeted group booking, and the exposure is confined to co-bookers of that shared booking, so real-world risk scales with how heavily a site relies on group bookings. No public exploit code and no CISA KEV listing were identified at time of analysis, though an independent assessment rates integrity and availability impact higher than the vendor vector (CVSS 3.1 C:H/I:H/A:L versus the published C:H/I:N/A:N), reflecting the token-reuse tampering path.
Unauthenticated attackers can read appointment and booking records from WordPress sites running the Simply Schedule Appointments plugin at version 1.6.12.31 or earlier by manipulating object identifiers passed to the plugin's public-facing endpoints, an insecure direct object reference (IDOR) issue tracked as CVE-2026-94673. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): no credentials, no user interaction, and only low-complexity remote requests are required, but impact is limited to confidentiality - data can be viewed, not altered or deleted. Exploitation is feasible against default configurations wherever the plugin is installed and its AJAX/REST endpoints are reachable; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so real-world urgency is moderate rather than critical, with exposure bounded to the objects the vulnerable endpoint exposes rather than the whole site.
Missing authorization checks in the Simply Schedule Appointments WordPress plugin through version 1.6.12.29 let unauthenticated remote users reach plugin functionality that should require a privileged role, exposing and potentially altering appointment-related data. Because the CVSS vector is PR:N/UI:N with AV:N/AC:L, any internet-facing WordPress installation running an affected version of the plugin needs no credentials, no user role, and no victim interaction to be targeted; the assessed impact is bounded to Low confidentiality and Low integrity loss rather than code execution, privilege escalation, or site takeover. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no vendor-released patch version is identified in the available data, so this is a genuine but moderate-priority issue that should be triaged against the actual presence and reachability of the plugin.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Missing Authorization in NSquared's Simply Schedule Appointments WordPress plugin (versions through 1.6.11.11) allows unauthenticated network attackers to bypass access control security levels, yielding limited confidentiality and integrity impact against affected WordPress sites. Reported by Patchstack under CWE-862, the flaw is automatable per CISA's SSVC framework, meaning it can be exploited at scale without human interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching.
Unauthenticated broken access control in the Simply Schedule Appointments WordPress plugin (versions through 1.6.12.4) allows remote attackers to perform unauthorized actions against appointment data, resulting in low-integrity and low-availability impacts. The plugin by NSquared fails to enforce proper authorization checks on one or more endpoints, enabling exploitation without any credentials against default installations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero privilege requirement lower the barrier for opportunistic abuse.
Missing authorization in NSquared Simply Schedule Appointments WordPress plugin through version 1.6.10.2 allows unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 (low-moderate) and EPSS probability of 0.02%, placing it in the lower-risk percentile despite public awareness. No active exploitation has been confirmed, and SSVC decision data indicates the issue is automatable but non-critical due to partial technical impact.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin.6.6.1. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.