Simply Schedule Appointments notification content permits unauthenticated stored XSS
Simply Schedule Appointments before 1.6.12.4 sanitizes notification content with wp_kses_post before decoding it into HTML. An unauthenticated attacker can submit double-encoded markup that survives the initial filter, becomes executable after decoding and runs when the stored notification is rendered, potentially in an administrator's browser. The CNA record does not disclose the submission endpoint, action, parameter or rendering function.
- Component
- Simply Schedule Appointments
- Plugin slug
simply-schedule-appointments- Affected
- < 1.6.12.4
- Safe version
1.6.12.4- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 31 known issues for this plugin.
Update, patch or deactivate.
Update Simply Schedule Appointments to 1.6.12.4 or later. Review stored appointment and notification content for encoded markup and remove suspicious entries before administrators view them.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N