CVE-2025-29448

A booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to perform a Denial of Service (DoS) attack. By exploiting insufficient validation in the register() function, an attacker can create appointments with excessively long durations (e.g., by modifying the post_data[ap...

CVE-2025-31828

CVE-2025-31828 is a CSRF vulnerability in Easy!Appointments affecting versions up to 1.4.2. The issue enables cross-site request forgery to change settings as described in the description. Public details in the initial document indicate a high-severity impact (CVSS v3.1 base 8.8) with network att...

CVE-2018-13063

Technical details about CVE-2018-13063 are not provided in the connected documents; only the basic description is present. Monitor for updates and additional disclosures to assess affected components, impact, and remediation.

CVE-2023-32295

CVE-2023-32295 relates to Easy!Appointments (WordPress plugin)

CVE-2024-0698

Summary: CVE-2024-0698 affects the Easy!Appointments WordPress plugin. The vulnerability is a stored XSS in shortcode handling due to insufficient input sanitization and output escaping on user-supplied attributes in all versions up to 1.3.1. Exploitation requires contributor-level (or higher) au...

CVE-2018-13060

CVE-2018-13060 affects Easy!Appointments 1.3.0. Multiple connected sources document a vulnerability where CAPTCHA protection can be bypassed, enabling an attacker to bypass CAPTCHA and potentially abuse the login/appointment flow. Root cause details in the sources indicate a guessable CAPTCHA iss...

CVE-2025-50383

The Easy!Appointments appointment management system (version 1.5.1 ) contains a SQL injection vulnerability within the order_by parameter. A low-privileged authenticated user (e.g., Customers or Providers ) can exploit this by sending a crafted HTTP POST request to specific search endpoints, such...

CVE-2019-14936

CVE-2019-14936 affects the WordPress plugin Easy!Appointments version 1.3.2. The vulnerability allows disclosure of sensitive information: usernames and password hashes. Public sources describe it as an information disclosure flaw in Easy!Appointments 1.3.2, with advisories noting a configuration...

CVE-2026-23622

CVE-2026-23622 involves a CSRF protection bypass in Easy!Appointments (versions ≤ 1.5.2) where application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests. As a result, state-changing endpoints that accept GET/$_REQUEST parameters—such as /admins/store, /admins/update, an...