WordPress security changelog
MEDIUM CVE-2026-13400 Deferred

Simply Schedule Appointments notification content permits unauthenticated stored XSS

Simply Schedule Appointments before 1.6.12.4 sanitizes notification content with wp_kses_post before decoding it into HTML. An unauthenticated attacker can submit double-encoded markup that survives the initial filter, becomes executable after decoding and runs when the stored notification is rendered, potentially in an administrator's browser. The CNA record does not disclose the submission endpoint, action, parameter or rendering function.

CVE / CNA score 6.1 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Simply Schedule Appointments
Plugin slug
simply-schedule-appointments
Affected
< 1.6.12.4
Safe version
1.6.12.4
Published
Jul 27, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Jul 27, 2026 and is one of 31 known issues for this plugin.

Update, patch or deactivate.

Update Simply Schedule Appointments to 1.6.12.4 or later. Review stored appointment and notification content for encoded markup and remove suspicious entries before administrators view them.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary and upstream sources