CVE-2026-15254

The CVE-2026-15254 entry concerns the Simply Schedule Appointments WordPress plugin before 1.6.12.11. The vulnerability: the plugin does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users. As a result, ...