CVE-2025-29448

CVE-2025-29448 affects Easy!Appointments v1.5.1. A booking logic flaw allows unauthenticated attackers to submit extremely long end_datetime values, enabling a denial of service by blocking all future booking availability. Technical details in connected docs show the impact as a DoS with availabi...

CVE-2018-13063

Technical details about CVE-2018-13063 are not provided in the connected documents; only the basic description is present. Monitor for updates and additional disclosures to assess affected components, impact, and remediation.

CVE-2025-31828

CVE-2025-31828 is a CSRF vulnerability in Easy!Appointments affecting versions up to 1.4.2. The issue enables cross-site request forgery to change settings as described in the description. Public details in the initial document indicate a high-severity impact (CVSS v3.1 base 8.8) with network att...

CVE-2018-13060

CVE-2018-13060 affects Easy!Appointments 1.3.0. Multiple connected sources document a vulnerability where CAPTCHA protection can be bypassed, enabling an attacker to bypass CAPTCHA and potentially abuse the login/appointment flow. Root cause details in the sources indicate a guessable CAPTCHA iss...

CVE-2023-32295

CVE-2023-32295 relates to Easy!Appointments (WordPress plugin)

CVE-2024-0698

Summary: CVE-2024-0698 affects the Easy!Appointments WordPress plugin. The vulnerability is a stored XSS in shortcode handling due to insufficient input sanitization and output escaping on user-supplied attributes in all versions up to 1.3.1. Exploitation requires contributor-level (or higher) au...

CVE-2025-50383

CVE-2025-50383 affects Easy!Appointments, specifically version 1.5.1, where a SQL injection vulnerability exists in the order_by parameter. The issue is confirmed by multiple sources in the connected documents, including CVE records and advisories. The CVSS v3.1 base score is 8.1 (HIGH), with net...

CVE-2019-14936

CVE-2019-14936 affects the WordPress plugin Easy!Appointments version 1.3.2. The vulnerability allows disclosure of sensitive information: usernames and password hashes. Public sources describe it as an information disclosure flaw in Easy!Appointments 1.3.2, with advisories noting a configuration...

CVE-2026-23622

CVE-2026-23622 involves a CSRF protection bypass in Easy!Appointments (versions ≤ 1.5.2) where application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests. As a result, state-changing endpoints that accept GET/$_REQUEST parameters—such as /admins/store, /admins/update, an...