EUVD-2026-90466

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-92245

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure and Arbitrary Appointment Deletion in versions up to and including 1.6.12.32 . The root cause is a missing authorization flaw involving the recursive parameter on the appointment_types REST endpo...

EUVD-2026-90464

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

CVE-2026-92245 Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

CVE-2026-94673

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

CVE-2026-94074

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-94673 WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

EUVD-2026-89847

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

CVE-2026-94673 WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

CVE-2026-94673

The Simply Schedule Appointments WordPress plugin versions

EUVD-2026-89830

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-94074 WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-94074 WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-94074

The Simply Schedule Appointments WordPress plugin, in versions

CVE-2026-89294

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

WordPress Simply Schedule Appointments plugin <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by crow in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.27...

CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

CVE-2026-89294

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.12.27 . The root cause is the 'ssa_locale' parameter, which processes raw GET values without nonce or capability checks during the plugins_loaded action. While...

EUVD-2026-89654

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...