WordPress security by component

Simply Schedule Appointments

Plugin description

Simply Schedule Appointments is a WordPress component with 31 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 9.3.

Plugin slug: simply-schedule-appointments

Latest vulnerability

CVE-2026-13400: Simply Schedule Appointments notification content permits unauthenticated stored XSS

Simply Schedule Appointments before 1.6.12.4 sanitizes notification content with wp_kses_post before decoding it into HTML. An unauthenticated attacker can submit double-encoded markup that survives the initial filter, becomes executable after decoding and runs when the stored notification is rendered, potentially in an administrator's browser. The CNA record does not disclose the submission endpoint, action, parameter or rendering function.

PublishedJul 27, 2026

Known safe version1.6.12.4

		Safe version
Jul 27, 2026	CVE-2026-13400 Simply Schedule Appointments notification content permits unauthenticated stored XSS Simply Schedule Appointments before 1.6.12.4 sanitizes notification content with wp_kses_post before decoding it into HTML. An unauthenticated attacker can submit double-encoded markup that survives the initial filter, becomes executable after decoding and runs when the stored notification is rendered, potentially in an administrator's browser. The CNA record does not disclose the submission endpoint, action, parameter or rendering function.	1.6.12.4	CVE6.1 NVDPending
Jul 13, 2026	CVE-2026-59523 Simply Schedule Appointments: A security weakness Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.11.11.	1.6.12.0	CVE6.5 NVDPending
Jul 13, 2026	CVE-2026-57812 Simply Schedule Appointments: A security weakness Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.12.4.	1.6.12.6	CVE6.5 NVDPending
Jun 26, 2026	CVE-2026-57317 Simply Schedule Appointments: Cross-site scripting Simply Schedule Appointments is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.6.12.2.	1.6.12.4	CVE7.1 NVDPending
Jun 15, 2026	CVE-2026-42384 Simply Schedule Appointments: A security weakness Simply Schedule Appointments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a to < 1.6.11.2.	1.6.11.2	CVE7.5 NVDPending
Jun 15, 2026	CVE-2026-39493 Simply Schedule Appointments: SQL injection Simply Schedule Appointments is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.6.9.27.	1.6.9.29	CVE9.3 NVDPending
Jun 15, 2026	CVE-2026-39447 Simply Schedule Appointments: Cross-site scripting Simply Schedule Appointments is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.6.10.6.	1.6.11.0	CVE7.1 NVDPending
May 28, 2026	CVE-2026-6937 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: A security weakness Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.11.8.	> 1.6.11.8	CVE5.3 NVDPending
May 28, 2026	CVE-2026-7797 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: SQL injection Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.6.11.8.	> 1.6.11.8	CVE7.5 NVDPending
May 27, 2026	CVE-2026-7493 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: A security weakness Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.11.5.	> 1.6.11.5	CVE5.3 NVDPending
May 07, 2026	CVE-2026-4807 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: A security weakness Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.10.6.	> 1.6.10.6	CVE6.5 NVDPending
Apr 08, 2026	CVE-2026-39694 Simply Schedule Appointments: A security weakness Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.10.2.	> 1.6.10.2	CVE5.3 NVDPending
Apr 08, 2026	CVE-2026-39495 Simply Schedule Appointments: SQL injection Simply Schedule Appointments is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.6.9.27.	1.6.9.29	CVE8.5 NVDPending
Mar 19, 2026	CVE-2026-3658 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: SQL injection Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5 NVDPending
Mar 13, 2026	CVE-2026-3045 Appointment Booking Calendar — Simply Schedule Appointments: A security weakness Appointment Booking Calendar — Simply Schedule Appointments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVDPending
Mar 13, 2026	CVE-2026-1704 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: A security weakness Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Mar 11, 2026	CVE-2026-1708 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: SQL injection Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5 NVDPending
Jan 22, 2026	CVE-2025-69315 Simply Schedule Appointments: A security weakness Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Jun 14, 2025	CVE-2025-4667 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: Cross-site scripting Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVDPending
Mar 07, 2025	CVE-2024-13431 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: Cross-site scripting Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1
Nov 05, 2024	CVE-2024-7877 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: Cross-site scripting Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Nov 05, 2024	CVE-2024-7876 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: Cross-site scripting Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Sep 13, 2024	CVE-2024-7129 Appointment Booking Calendar: Code execution Appointment Booking Calendar is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.2 NVD7.2
May 16, 2024	CVE-2024-4288 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: Cross-site scripting Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 09, 2024	CVE-2024-2342 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: SQL injection Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVDPending
Apr 09, 2024	CVE-2024-2341 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: SQL injection Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVD6.5
Mar 27, 2024	CVE-2024-22311 Simply Schedule Appointments: Cross-site scripting Simply Schedule Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVDPending
Mar 06, 2024	CVE-2024-1760 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: Cross-site request forgery Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD4.7
Dec 28, 2023	CVE-2023-50851 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: SQL injection Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.6 NVD7.2
Aug 29, 2022	CVE-2022-2374 Simply Schedule Appointments: Cross-site scripting Simply Schedule Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Aug 29, 2022	CVE-2022-2373 Simply Schedule Appointments: A security weakness Simply Schedule Appointments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD5.3