690 matches found
Easy Appointments <= 3.12.21 - Information Disclosure
Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...
WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure
WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...
CVE-2025-50383
CVE-2025-50383 Descripción Un usuario autenticado con pocos privilegios puede explotar esta vulnerabilidad enviando una solicitud HTTP POST manipulada con un parámetro orderby malicioso por ejemplo, orderby=IF1=1,SLEEP5,1. Esto puede desencadenar una inyección SQL ciega basada en tiempo, lo que...
CVE-2026-61946-Easy-Appointments-IDOR
CVE-2026-61946: El ID de una cita que conduce a la reserva de otra persona Encontré una referencia directa a objetos insegura sin autenticación en el plugin Easy Appointments de WordPress. El endpoint público de reservas aceptaba un id de la cadena de consulta y pasaba los datos resultantes a la...
CVE-2025-29448
CVE-2025-29448 Descripción fallo en la lógica de reservas en Easy!Appointments v1.5.1 permite a atacantes no autenticados crear citas con duraciones excesivamente largas, causando una denegación de servicio al bloquear toda la disponibilidad futura de reservas. Pasos para Reproducir 1. Intercepta...
EUVD-2026-76874
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...
exploit-CVE-2022-0482
Divulgación de PII de Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...
CVE-2026-77689
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...
EUVD-2026-76813
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...
CVE-2026-16540-SimplyScheduleAppointments
CVE-2026-16540 — Simply Schedule Appointments 1.6.12.6 Divulgación no autenticada de datos de citas y eliminación masiva a través del endpoint purge...
CVE-2022-0482_exploit
CVE-2022-0482 漏洞利用 简介 本文档详细分析了 CVE-2022-0482，这是 Easy!Appointments 预约管理软件中存在的一个严重安全漏洞。该漏洞属于 CWE-863 下的授权不正确，允许未经授权的人员在无需适当认证的情况下访问个人身份信息，对数据的机密性和完整性构成重大风险。 作者 Mija Pilkaite 漏洞概述 CVE-2022-0482 影响 Easy!Appointments 1.4.3 之前的版本。该漏洞由 Francesco Carlucci 于 2022 年 1 月 30...
hdwebmobile-booking-appointments
HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...
CVE-2026-81798
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
EUVD-2026-72648
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
CVE-2026-81798
WordPress Easy Appointments plugin (versions up to and including 4.0.2.1 ) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The CVSS 3.1 score is 7.1 (HIGH) , with a network attack vector, low complexity, no privileges ...
CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...
PT-2026-86990
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...