Simply Schedule Appointments

Simply Schedule Appointments through 1.6.12.23 does not adequately protect an affected state-changing operation from cross-site request forgery. An attacker can induce an interacting logged-in user to submit the request with the victim's WordPress privileges.

Simply Schedule Appointments through 1.6.12.10 exposes /wp-json/ssa/v1/render-shortcode to any Contributor through an edit_posts permission check. Supplying ssa_past_appointments for another user's records returns appointment HTML containing 32-character ownership tokens; those tokens can then be used without authentication to read or modify the appointments, including customer name, email, phone, and private notes. The identifier parameter and token-consuming routes are not disclosed.

Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 1.6.12.17.

An unauthenticated visitor can submit attacker-controlled content that Simply Schedule Appointments 1.6.12.10 and earlier renders without sufficient output encoding.

An unauthenticated attacker can send crafted input that reaches a database query without safe parameterization in Simply Schedule Appointments 1.6.12.10 and earlier. Successful exploitation can read or alter WordPress database data within the permissions of the site database account.

Simply Schedule Appointments before 1.6.12.11 omits a capability check from an administrative appointment-listing shortcode and its per-user filter fails open for non-staff users. A Contributor-or-higher user can render the shortcode and disclose every customer's appointment record across the site, including names, email addresses, phone numbers and notes.

Simply Schedule Appointments before 1.6.12.6 does not bind a bulk appointment operation to records owned by the requester. An unauthenticated visitor can retrieve the personal data stored for every appointment; on premium editions, the same authorization failure also permits permanent deletion.

Simply Schedule Appointments before 1.6.12.4 sanitizes notification content with wp_kses_post before decoding it into HTML. An unauthenticated attacker can submit double-encoded markup that survives the initial filter, becomes executable after decoding and runs when the stored notification is rendered, potentially in an administrator's browser.

Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.11.11.

Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.12.4.

Simply Schedule Appointments is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.6.12.2.

Simply Schedule Appointments is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is n/a to < 1.6.11.2.

Simply Schedule Appointments is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.6.9.27.

Simply Schedule Appointments is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.6.10.6.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.11.8.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.6.11.8.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by denial of service. The vulnerable path is reachable without authentication. A successful request can exhaust or disrupt the affected operation and make site functionality unavailable. The published affected range is <= 1.6.11.5.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.10.6.

Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.10.2.

Simply Schedule Appointments is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.6.9.27.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Appointment Booking Calendar — Simply Schedule Appointments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Simply Schedule Appointments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Appointment Booking Calendar is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. Exploitation requires an authenticated subscriber account. A successful request can alter database queries and expose or modify WordPress data.

Simply Schedule Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Simply Schedule Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Simply Schedule Appointments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.