288 matches found
CVE-2026-61946-Easy-Appointments-IDOR
CVE-2026-61946: One Appointment ID to Somebody Else's Booking I found an unauthenticated insecure direct object reference in the WordPress Easy Appointments plugin. The public reservation endpoint accepted an id from the query string and passed the resulting data into the plugin's database replac...
CVE-2025-29448
CVE-2025-29448 Descripción fallo en la lógica de reservas en Easy!Appointments v1.5.1 permite a atacantes no autenticados crear citas con duraciones excesivamente largas, causando una denegación de servicio al bloquear toda la disponibilidad futura de reservas. Pasos para Reproducir 1. Intercepta...
exploit-CVE-2022-0482
Divulgación de PII de Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...
Easy Appointments <= 3.12.21 - Information Disclosure
Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...
CVE-2022-0482_exploit
Explotación de la vulnerabilidad CVE-2022-0482 Introducción Este documento describe el análisis detallado de CVE-2022-0482, una vulnerabilidad crítica de seguridad identificada en el software de programación Easy!Appointments. Esta falla, relacionada con la Autorización Incorrecta según CWE-863,...
CVE-2026-81798
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
EUVD-2026-72648
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
CVE-2026-81798
WordPress Easy Appointments plugin (versions up to and including 4.0.2.1 ) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The CVSS 3.1 score is 7.1 (HIGH) , with a network attack vector, low complexity, no privileges ...
CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
PT-2026-86990
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
CVE-2025-50383
CVE-2025-50383 Description A low-privileged authenticated user can exploit this vulnerability by sending a crafted HTTP POST request with a malicious orderby parameter e.g., orderby=IF1=1,SLEEP5,1. This can trigger time-based blind SQL injection, resulting in unauthorized SQL execution on the...
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...
EUVD-2026-62288
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...
EUVD-2026-54187
The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to...
CVE-2026-14225
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...
CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...
CVE-2026-14225
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...