CVE-2026-14224

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...

EUVD-2026-50119

The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...

CVE-2026-14224

CVE-2026-14224 affects the Easy Appointments WordPress plugin (up to version 3.12.26). The vulnerability is an IDOR in the customer-data update flow: the action only checks a nonce that can be obtained by any authenticated user from their own appointment, allowing a subscriber-level user to reuse...

CVE-2026-14224

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...

CVE-2026-14224 Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...

CVE-2026-14224 Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...

WordPress BookingPress Appointment Booking Pro 5.7.2 Authentication Bypass

WordPress BookingPress Appointment Booking Pro plugin version 5.7.2 contains an authentication bypass vulnerability in its REST API that may allow an unauthenticated attacker to bypass authentication and gain unauthorized access. The repository contains technical analysis, threat intelligence...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.5), @aaravpos/appointment-booking-plugin (>=1.0.1, <=7.0.6) +264 more potentially affected by CVE-2026-53667 via react-router (>=7.11.0, <=7.17.0)

react-router NPM version =7.11.0, =1.0.0, =1.0.1, =0.0.9-alpha-20251217170854-13a5505369f22d85f29bcbbbe455c23672e2aca3, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

CVE-2026-65514

CVE-2026-65514 affects the WordPress plugin Appointment Hour Booking up to version 1.5.86, with a reported Cross Site Scripting (XSS) vulnerability. The CVSS 3.1 base score is 6.5 (Medium); attack vector is network, attack complexity low, privileges required low, and user interaction is required,...

EUVD-2026-48119

Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...

CVE-2026-27377

CVE-2026-27377 affects the WordPress plugin QuickCal – Appointment Booking Calendar for WordPress (versions

EUVD-2026-48154

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...

WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Appointment Hour Booking versions = 1.5.86...

Exploit for CVE-2026-16540

CVE-2026-16540 — Simply Schedule Appointments WPRESTServer:...

CVE-2026-11866

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the...

EUVD-2026-44871

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the...

CVE-2026-11866

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the...

Information Exposure

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Information Exposure via the customers search endpoint. An attacker can access appointment hashes belonging to other...

CVE-2026-55651

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointmen...

CVE-2026-55651

Easy!Appointments exposes an Excessive Data Exposure vulnerability in the customers search endpoint (affected in 1.5.2) that allows an authenticated user to obtain appointment hashes belonging to other users, enabling modification or deletion of others’ appointments and leading to an Appointments...