Skip to content

Croixhaug vulnerabilities

Products

Newest

croixhaug simply schedule appointments Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} CVE-2026-104000 7.2 HighOctober 16, 2026
croixhaug simply schedule appointments Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token CVE-2026-6723 5.3 MediumOctober 10, 2026
croixhaug simply schedule appointments Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter CVE-2026-91109 6.5 MediumOctober 1, 2026
croixhaug simply schedule appointments Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_type… CVE-2026-92245 7.5 HighOctober 1, 2026
croixhaug simply schedule appointments Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter CVE-2026-89294 7.5 HighSeptember 30, 2026
croixhaug simply schedule appointments Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure CVE-2026-13358 6.5 MediumAugust 16, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint CVE-2026-6937 5.3 MediumMay 28, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter CVE-2026-7797 7.5 HighMay 28, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service CVE-2026-7493 5.3 MediumMay 27, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion CVE-2026-4807 6.5 MediumMay 7, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter CVE-2026-3658 7.5 HighMarch 19, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint CVE-2026-3045 7.5 HighMarch 13, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure CVE-2026-1704 4.3 MediumMarch 13, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter CVE-2026-1708 7.5 HighMarch 11, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters CVE-2025-12166 7.5 HighJanuary 14, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure CVE-2025-11723 6.5 MediumJanuary 6, 2026
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2025-13754 5.3 MediumDecember 19, 2025
croixhaug appointment booking calendar — simply schedule appointments booking plugin Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes CVE-2025-4667 6.4 MediumJune 14, 2025
croixhaug appointment booking calendar — simply schedule appointments booking plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-1119 7.3 HighMarch 13, 2025
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared appointment booking calendar +1 more Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting CVE-2024-13431 6.1 MediumMarch 7, 2025
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 more Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS CVE-2024-7877 4.8 MediumNovember 5, 2024
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 more Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS CVE-2024-7876 4.8 MediumNovember 5, 2024
nsquared appointment booking calendar, croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +2 more Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE CVE-2024-7129 7.2 HighSeptember 13, 2024
croixhaug appointment booking calendar — simply schedule appointments booking plugin, n squared appointment booking calendar, nsquared simply schedule appointments +2 more Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4288 6.4 MediumMay 16, 2024
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared simply schedule appointments +1 more Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection CVE-2024-2341 8.8 HighApril 9, 2024
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared simply schedule appointments +1 more Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode CVE-2024-2342 8.8 HighApril 9, 2024
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +1 more Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset CVE-2024-1760 4.3 MediumMarch 6, 2024
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +1 more WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection CVE-2023-50851 7.6 HighDecember 28, 2023
nsqua draw attention, croixhaug interactive image map plugin – draw attention +1 more Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification CVE-2023-2764 4.3 MediumJune 9, 2023