956 matches found
PT-2026-66381
The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
CVE-2026-14223: Authorization Bypass Through User-Controlled Key
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...
PT-2026-66378
The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...
CVE-2026-14226: Exposure of Sensitive Information to an Unauthorized Actor
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...
CVE-2026-14222: Improper Access Control
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
PT-2026-66382
The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...
CVE-2026-52841
creationtimestamp| type| source ---|---|--- 2026-07-29 18:35:16+00:00| published-proof-of-concept| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr 2026-07-30 03:31:37+00:00| seen| https://gist.github.com/alon710/555463e864b3e92acb0ee1bba5502d4f...
EUVD-2026-43723
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Summary The booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ..., ... without authentication and without field whitelisting. Anyone in possession of the...
GHSA-XGR6-PQJV-3PF8 Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Summary The booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ..., ... without authentication and without field whitelisting. Anyone in possession of the...
GHSA-4VMM-5QVC-W5P7 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...
WordPress Simply Schedule Appointments plugin < 1.6.12.4 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Simply Schedule Appointments versions 1.6.12.4...
CVE-2026-14224
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...
EUVD-2026-50119
The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...
WordPress Easy Appointments plugin <= 3.12.26 - Subscriber+ Cross-User Appointment Data Modification vulnerability
Subscriber+ Cross-User Appointment Data Modification vulnerability discovered by Duy Tran in WordPress Plugin Easy Appointments versions = 3.12.26...
CVE-2026-14224
The Easy Appointments WordPress plugin versions prior to 3.12.28 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the appointment targeted by its customer-data update action belongs to the authenticated user, relying instead on a shared nonce that ...
PT-2026-65695
The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover...
CVE-2026-14224: Authorization Bypass Through User-Controlled Key
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...