WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...

CVE-2026-16540-SimplyScheduleAppointments

CVE-2026-16540 — Simply Schedule Appointments 1.6.12.6 Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint Field| Details ---|--- CVE| CVE-2026-16540 Plugin| Simply Schedule Appointments Affected Versions| 1.6.12.6 Fixed In| 1.6.12.6 Active Installs| 70,000 CVSS 3.1|...

CVE-2026-110382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

EUVD-2026-103423

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

CVE-2026-110382 WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

CVE-2026-110382

The NSquared Simply Schedule Appointments WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) flaw (CWE-79) due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.6.12.35 . Exploitation details and specific remediation ...

CVE-2026-110382 WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

CVE-2026-110382: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

PT-2026-116593

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

NSquared Simply Schedule Appointments Cross-site Script Vulnerability

NSquared Simply Schedule Appointments 1.6.12.35 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and it may lead to storage-type cross-site scripting attacks...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khanh Nguyen in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

CVE-2026-104000

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-104000 Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-104000 Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-104000

The Simply Schedule Appointments plugin for WordPress (versions up to and including 1.6.12.35 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw exists in the 'status' parameter via the /wp-json/ssa/v1/appointments/{id} endpoint due to insufficient input sanitization ...

EUVD-2026-102663

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-104000: Improper Neutralization of Input During Web Page Generation

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-115446

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-110381

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...