EUVD-2026-50988

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin, in versions prior to 1.9.3 , contains an authorization flaw due to an operator-precedence error . This flaw allows authenticated users with limited privileges, such as a Contributor (who only holds post-editing capabilities), to bypass intended rest...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14188

The Easy Appointments WordPress plugin before version 3.12.28 is vulnerable to a customer data disclosure flaw. The root cause is the lack of per-request capability or nonce checks on one of its customer-listing handlers. This allows authenticated users with contributor-level access to read the p...

EUVD-2026-50982

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Customer Data Disclosure vulnerability

Contributor+ Customer Data Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Easy Appointments versions = 3.12.26...

CVE-2026-14221

The Easy Appointments WordPress plugin (versions through 4.0 ) is vulnerable to improper access control because it fails to perform adequate capability checks on various appointment-management actions. Instead, the plugin relies solely on a nonce , which can be obtained by any authenticated user....

CVE-2026-14222

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

EUVD-2026-50983

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14188

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14222

The Easy Appointments WordPress plugin (versions before 3.12.28 ) is vulnerable to an improper access control flaw. The plugin fails to perform necessary capability or nonce checks during specific connection-deletion actions. This allows users with contributor-level access to delete the booking c...

EUVD-2026-50981

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14221 Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification vulnerability

Contributor+ Appointment Data Disclosure & Modification vulnerability discovered by Youssef massoudi in WordPress Plugin Easy Appointments versions = 3.12.26...

CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14221

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

CVE-2026-14221 Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...