WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...

CVE-2026-110382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

EUVD-2026-103423

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

CVE-2026-110382

The NSquared Simply Schedule Appointments WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) flaw (CWE-79) due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.6.12.35 . Exploitation details and specific remediation ...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khanh Nguyen in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

CVE-2026-104000

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-104000

The Simply Schedule Appointments plugin for WordPress (versions up to and including 1.6.12.35 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw exists in the 'status' parameter via the /wp-json/ssa/v1/appointments/{id} endpoint due to insufficient input sanitization ...

CVE-2026-104000 Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-102663

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-110381

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

CVE-2026-110381 WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

CVE-2026-110381

The Simply Schedule Appointments WordPress plugin (versions

EUVD-2026-102234

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by ssophiz in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

CVE-2026-16540-SimplyScheduleAppointments

CVE-2026-16540 — Simply Schedule Appointments 1.6.12.6 Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint Field| Details ---|--- CVE| CVE-2026-16540 Plugin| Simply Schedule Appointments Affected Versions| 1.6.12.6 Fixed In| 1.6.12.6 Active Installs| 70,000 CVSS 3.1|...

VulnCheck KEV: CVE-2026-3045

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: 1 a non-user-bound publicnonce is exposed to unauthenticated users...

VulnCheck KEV: CVE-2026-39447

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.10.6 versions...

VulnCheck KEV: CVE-2026-57812

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through = 1.6.12.4...

CVE-2026-6723

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by...