Simply Schedule Appointments
Monthly
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauthenticated remote attacker to perform arbitrary privileged actions on behalf of a logged-in WordPress administrator. By luring an authenticated admin into loading a malicious web page or clicking a crafted link, the attacker's forged request is executed with the victim's full session privileges - potentially manipulating appointment data, customer records, and plugin configuration. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is reported by Patchstack.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.
Unauthenticated sensitive data exposure in the Simply Schedule Appointments WordPress plugin versions prior to 1.6.11.2 allows remote attackers to retrieve protected information without credentials over the network. The flaw is reported by Patchstack and carries a CVSS 7.5 (high) confidentiality-only impact, with no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote attackers to inject crafted SQL through plugin endpoints without authentication. The flaw carries a CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the vulnerable component, though only confidentiality (High) and availability (Low) are affected per the vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.10.6) allows remote attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link or page. Successful exploitation can lead to session hijacking, credential theft, or administrative actions performed in the context of the targeted user. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Blind SQL injection in NSquared Simply Schedule Appointments WordPress plugin versions ≤1.6.9.27 allows authenticated attackers with low-privilege access to extract sensitive database contents and potentially trigger denial-of-service conditions. The vulnerability stems from improper neutralization of SQL special elements in user-controlled input. Network-accessible exploitation requires valid credentials but no user interaction. CVSS 8.5 severity reflects high confidentiality impact with scope change, enabling cross-boundary data access. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%, 6th percentile).
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Missing Authorization in NSquared's Simply Schedule Appointments WordPress plugin (versions through 1.6.11.11) allows unauthenticated network attackers to bypass access control security levels, yielding limited confidentiality and integrity impact against affected WordPress sites. Reported by Patchstack under CWE-862, the flaw is automatable per CISA's SSVC framework, meaning it can be exploited at scale without human interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching.
Unauthenticated broken access control in the Simply Schedule Appointments WordPress plugin (versions through 1.6.12.4) allows remote attackers to perform unauthorized actions against appointment data, resulting in low-integrity and low-availability impacts. The plugin by NSquared fails to enforce proper authorization checks on one or more endpoints, enabling exploitation without any credentials against default installations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero privilege requirement lower the barrier for opportunistic abuse.
Missing authorization in NSquared Simply Schedule Appointments WordPress plugin through version 1.6.10.2 allows unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 (low-moderate) and EPSS probability of 0.02%, placing it in the lower-risk percentile despite public awareness. No active exploitation has been confirmed, and SSVC decision data indicates the issue is automatable but non-critical due to partial technical impact.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin.6.6.1. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauthenticated remote attacker to perform arbitrary privileged actions on behalf of a logged-in WordPress administrator. By luring an authenticated admin into loading a malicious web page or clicking a crafted link, the attacker's forged request is executed with the victim's full session privileges - potentially manipulating appointment data, customer records, and plugin configuration. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is reported by Patchstack.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.
Unauthenticated sensitive data exposure in the Simply Schedule Appointments WordPress plugin versions prior to 1.6.11.2 allows remote attackers to retrieve protected information without credentials over the network. The flaw is reported by Patchstack and carries a CVSS 7.5 (high) confidentiality-only impact, with no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote attackers to inject crafted SQL through plugin endpoints without authentication. The flaw carries a CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the vulnerable component, though only confidentiality (High) and availability (Low) are affected per the vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.10.6) allows remote attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link or page. Successful exploitation can lead to session hijacking, credential theft, or administrative actions performed in the context of the targeted user. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Blind SQL injection in NSquared Simply Schedule Appointments WordPress plugin versions ≤1.6.9.27 allows authenticated attackers with low-privilege access to extract sensitive database contents and potentially trigger denial-of-service conditions. The vulnerability stems from improper neutralization of SQL special elements in user-controlled input. Network-accessible exploitation requires valid credentials but no user interaction. CVSS 8.5 severity reflects high confidentiality impact with scope change, enabling cross-boundary data access. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%, 6th percentile).
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Missing Authorization in NSquared's Simply Schedule Appointments WordPress plugin (versions through 1.6.11.11) allows unauthenticated network attackers to bypass access control security levels, yielding limited confidentiality and integrity impact against affected WordPress sites. Reported by Patchstack under CWE-862, the flaw is automatable per CISA's SSVC framework, meaning it can be exploited at scale without human interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching.
Unauthenticated broken access control in the Simply Schedule Appointments WordPress plugin (versions through 1.6.12.4) allows remote attackers to perform unauthorized actions against appointment data, resulting in low-integrity and low-availability impacts. The plugin by NSquared fails to enforce proper authorization checks on one or more endpoints, enabling exploitation without any credentials against default installations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero privilege requirement lower the barrier for opportunistic abuse.
Missing authorization in NSquared Simply Schedule Appointments WordPress plugin through version 1.6.10.2 allows unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 (low-moderate) and EPSS probability of 0.02%, placing it in the lower-risk percentile despite public awareness. No active exploitation has been confirmed, and SSVC decision data indicates the issue is automatable but non-critical due to partial technical impact.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin.6.6.1. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.