Unknown Schedule vulnerabilities

• kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure CVE-2026-118188 4.3 MediumNovember 6, 2026
• kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR CVE-2026-118187 2.7 LowNovember 6, 2026
• kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow CVE-2026-118186 4.9 MediumNovember 6, 2026
• publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categories PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes CVE-2026-105261 6.8 MediumOctober 14, 2026
• unknown tz weekly radio schedule Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell CVE-2026-87775 8.6 HighSeptember 18, 2026
• unknown tz weekly radio schedule Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week CVE-2026-87774 8.6 HighSeptember 18, 2026
• nsquared simply schedule appointments Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints CVE-2026-16541 6.5 MediumAugust 15, 2026
• nsquared simply schedule appointments Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode CVE-2026-15254 6.5 MediumAugust 3, 2026
• nsquared simply schedule appointments Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint CVE-2026-16540 Public exploit 7.5 HighAugust 2, 2026
• nsquared simply schedule appointments Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information CVE-2026-13400 6.1 MediumJuly 27, 2026
• jetmonsters timetable and event schedule by motopress Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function CVE-2026-9228 4.3 MediumMay 28, 2026
• unknown timetable and event schedule by motopress Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR CVE-2025-12954 2.7 LowDecember 3, 2025
• adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 more Blog2Social: Social Media Auto Post & Scheduler < 8.4.0 - Contributor+ Stored XSS CVE-2025-4133 5.4 MediumMay 22, 2025
• hijiriworld advanced schedule posts Advanced Schedule Posts <= 2.1.8 - Reflected XSS CVE-2024-0249 7.1 HighMay 15, 2025
• notfound schedule Schedule <= 1.0.0 - Reflected XSS CVE-2024-13891 7.1 HighMarch 13, 2025
• croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 more Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS CVE-2024-7877 4.8 MediumNovember 5, 2024
• croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 more Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS CVE-2024-7876 4.8 MediumNovember 5, 2024
• jetmonsters timetable and event schedule by motopress, motopress timetable and event schedule +1 more Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization CVE-2020-36840 7.3 HighOctober 16, 2024
• nsquared appointment booking calendar, croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +2 more Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE CVE-2024-7129 7.2 HighSeptember 13, 2024
• jetmonsters timetable and event schedule by motopress Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection CVE-2024-3342 9.9 CriticalApril 27, 2024
• adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 more Blog2Social < 7.2.1 - Reflected XSS CVE-2023-3936 6.1 MediumAugust 21, 2023
• nlb-creations scheduled announcements widget Scheduled Announcements Widget < 1.0 - Contributor+ Stored XSS CVE-2023-0363 5.4 MediumApril 10, 2023
• adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 more Blog2Social < 6.9.10 - Subscriber+ SSRF CVE-2022-3247 6.5 MediumOctober 25, 2022
• adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 more Blog2Social < 6.9.10 - Subscriber+ SQLi CVE-2022-3246 8.8 HighOctober 25, 2022
• nsqua simply schedule appointments, unknown simply schedule appointments – wordpress booking plugin +1 more Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting CVE-2022-2374 4.8 MediumAugust 29, 2022
• nsqua simply schedule appointments, unknown simply schedule appointments – wordpress booking plugin +1 more Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure CVE-2022-2373 5.3 MediumAugust 29, 2022
• myceliumdesign conference scheduler Conference Scheduler < 2.4.3 - Reflected Cross-Site Scripting CVE-2022-0600 6.1 MediumMarch 28, 2022
• adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 more Blog2Social < 6.8.7 - Reflected Cross-Site Scripting CVE-2021-24956 6.1 MediumDecember 21, 2021
• motopress timetable and event schedule, unknown timetable and event schedule by motopress +1 more Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure CVE-2021-24585 6.5 MediumSeptember 20, 2021
• motopress timetable and event schedule, unknown timetable and event schedule by motopress +1 more Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update CVE-2021-24584 5.4 MediumSeptember 20, 2021
• motopress timetable and event schedule, unknown timetable and event schedule by motopress +1 more Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion CVE-2021-24583 4.3 MediumSeptember 20, 2021
• motopress timetable and event schedule, unknown timetable and event schedule by motopress +1 more Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting CVE-2021-24724 5.4 MediumSeptember 13, 2021
• unknown weekly schedule, weekly schedule project schedule +1 more Weekly Schedule < 3.4.3 - Authenticated Stored XSS CVE-2021-24309 5.4 MediumJune 1, 2021
• adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 more Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection CVE-2021-24137 8.8 HighMarch 18, 2021