Skip to contentCroixhaug Simply Schedule Appointments vulnerabilities
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}CVE-2026-1040007.2 High
- croixhaug simply schedule appointmentsAppointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public TokenCVE-2026-67235.3 Medium
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' ParameterCVE-2026-911096.5 Medium
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_type…CVE-2026-922457.5 High
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' ParameterCVE-2026-892947.5 High
- croixhaug simply schedule appointmentsAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information ExposureCVE-2026-133586.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API EndpointCVE-2026-69375.3 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' ParameterCVE-2026-77977.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of ServiceCVE-2026-74935.3 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and DeletionCVE-2026-48076.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' ParameterCVE-2026-36587.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API EndpointCVE-2026-30457.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information ExposureCVE-2026-17044.3 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' ParameterCVE-2026-17087.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginSimply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` ParametersCVE-2025-121667.5 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information ExposureCVE-2025-117236.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information ExposureCVE-2025-137545.3 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginSimply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesCVE-2025-46676.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2025-11197.3 High
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared appointment booking calendar +1 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site ScriptingCVE-2024-134316.1 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 moreAppointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSSCVE-2024-78774.8 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 moreAppointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSSCVE-2024-78764.8 Medium
- nsquared appointment booking calendar, croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +2 moreAppointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCECVE-2024-71297.2 High
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, n squared appointment booking calendar, nsquared simply schedule appointments +2 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-42886.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared simply schedule appointments +1 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL InjectionCVE-2024-23418.8 High
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared simply schedule appointments +1 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via ShortcodeCVE-2024-23428.8 High
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +1 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data ResetCVE-2024-17604.3 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +1 moreWordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL InjectionCVE-2023-508517.6 High