1029 matches found
CVE-2026-13400 Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
CVE-2026-13400
The Simply Schedule Appointments WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 1.6.12.2 . The root cause is a sanitization-ordering defect where notification content is decoded back into live HTML after passing through the ...
CVE-2026-13400 Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
PT-2026-64839
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
CVE-2025-50455
SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...
CVE-2026-13400: Improper Neutralization of Input During Web Page Generation
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
Exploit for CVE-2026-61946
CVE-2026-61946: One Appointment ID to Somebody Else's Booking...
CVE-2026-8789
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
EUVD-2026-48600
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
CVE-2026-8789
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
CVE-2026-8789 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
CVE-2026-8789
The Easy Appointments WordPress plugin is vulnerable to unauthorized data modification via the ea_delete_multiple_connections AJAX action, due to a missing capability check and missing nonce verification in all versions up to 3.12.27. Authenticated attackers with Contributor-level access and abov...
CVE-2026-8789: Incorrect Authorization
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
PT-2026-64321
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the ea delete multiple connections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
WordPress Easy Appointments plugin <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Connection Deletion vulnerability discovered by Vamshi Krishna Upadrasta in WordPress Plugin Easy Appointments versions = 3.12.27...
CVE-2026-61946
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
EUVD-2026-48204
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...