956 matches found
EUVD-2026-59859
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...
CVE-2026-13358 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...
CVE-2026-13358
The CVE concerns the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. Affected: all versions up to and including 1.6.12.10. Issue: Insecure Direct Object Reference via the ssa_past_appointments key due to missing validation, allowing authenticated attac...
CVE-2026-13358
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...
PT-2026-73084
Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin versions prior to 1.6.12.11 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key within ssa past appointments...
CVE-2026-13358: Authorization Bypass Through User-Controlled Key
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
EUVD-2026-59589
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
CVE-2026-16541 Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
CVE-2026-16541 Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin versions before 1.6.12.17 is vulnerable to an information disclosure flaw. The plugin fails to restrict user records returned by certain REST endpoints to only those the requester is authorized to view. This allows a user with a low-privileged sta...
CVE-2026-16541: Exposure of Sensitive Information to an Unauthorized Actor
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
PT-2026-72163
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
CVE-2026-66462
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
CVE-2026-66462 WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
CVE-2026-66462 WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
CVE-2026-66462
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
EUVD-2026-57881
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
CVE-2026-66462
Summary (CVE-2026-66462) : Unauthenticated sensitive data exposure in the WordPress WooCommerce Appointments plugin, versions ≤ 5.3.8. The vulnerability affects the plugin itself (no vendor/component details beyond the plugin) and is described as unauthenticated exposure of sensitive data. No exp...
CVE-2026-14213
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...