PT-2024-22424 · WordPress · Easyappointments

Name of the Vulnerable Software and Affected Versions: Easy Appointments plugin for WordPress versions up to, and including, 3.11.18 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ea full calendar' shortcode due to insufficient input sanitization and output...

PT-2024-22436 · WordPress · Easyappointments

Name of the Vulnerable Software and Affected Versions: Easy Appointments plugin for WordPress versions up to, and including, 3.11.18 Description: The issue arises from insufficient user validation on the ajax cancel appointment function, allowing unauthenticated attackers to cancel other users'...

Easy Appointments < 3.11.19 - Insufficient Authorization

Description The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajaxcancelappointment function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other...

CVE-2024-0698

The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-0698 Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-0698

Summary: CVE-2024-0698 affects the Easy!Appointments WordPress plugin. The vulnerability is a stored XSS in shortcode handling due to insufficient input sanitization and output escaping on user-supplied attributes in all versions up to 1.3.1. Exploitation requires contributor-level (or higher) au...

CVE-2024-0698 Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Easy!Appointments Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy!Appointments Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0698 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1c6efbf20ae Credits wesley wcraft Required...

WordPress Easy!Appointments Plugin <= 1.3.3 is vulnerable to Arbitrary File Deletion

Software Easy!Appointments Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.4.0 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-32295 Patch priority High CVSS severity High 6.3 Developer Claim ownership PSID 8a50196a1675 Credits Jonas Höbenreich Requir...

The vulnerability of the Easy!Appointments web application is related to lack of access control, allowing an attacker to gain unauthorized access to limited functions.

The vulnerability of the Easy!Appointments web application is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to limited functions of the application...

CVE-2022-36424

Cross-Site Request Forgery CSRF vulnerability in Nikola Loncar Easy Appointments plugin = 3.11.9 versions...

CVE-2022-36424

Cross-Site Request Forgery CSRF vulnerability in Nikola Loncar Easy Appointments plugin = 3.11.9 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Nikola Loncar Easy Appointments plugin = 3.11.9 versions...

CVE-2022-36424

CVE-2022-36424 documents a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Easy Appointments, affecting versions up to and including 3.11.9. The issue, caused by insufficient CSRF protection for multiple AJAX actions, could allow an attacker to trigger unintended actions o...

CVE-2022-36424 WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Nikola Loncar Easy Appointments plugin = 3.11.9 versions...

CVE-2022-36424 WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Nikola Loncar Easy Appointments plugin = 3.11.9 versions...

Easy!Appointments Improper Access Control vulnerability

Easy!Appointments 1.4.3 and prior has an Improper Access Control vulnerability. This issue is patched at commit b37b46019553089db4f22eb2fe998bca84b2cb64 and anticipated to be part of version 1.5.0...

GHSA-8C6Q-26W6-QWHG Easy!Appointments Improper Access Control vulnerability

Easy!Appointments 1.4.3 and prior has an Improper Access Control vulnerability. This issue is patched at commit b37b46019553089db4f22eb2fe998bca84b2cb64 and anticipated to be part of version 1.5.0...

Easy!Appointments 访问控制错误漏洞

Easy!Appointments is a web-based appointment and schedule management system. An access control error vulnerability exists in versions prior to Easy!Appointments 1.5.0 that stems from the presence of an access control error vulnerability...

WordPress plugin Easy Appointments 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...