Croixhaug vulnerabilities
We track 10 vulnerabilities in Croixhaug products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Croixhaug vulnerabilities
- 7.2 High severity
Simply Schedule Appointments: Improper Neutralization of Input During Web Page Generation
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for
- 7.5 High severity
Simply Schedule Appointments: Missing Authorization
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII —
- 7.5 High severity
Simply Schedule Appointments: Improper Control of Filename for Include/Require Statement in PHP Program
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level acce
- 7.5 High severity
Appointment Booking Calendar — Simply Schedule…: Improper Neutralization of Special Elements used in an SQL Command
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'append_where_sql' parameter in all versions up to, and including, 1.6.11.8 due to insufficient escaping
- 7.5 High severity
Appointment Booking Calendar — Simply Schedule…: Improper Neutralization of Special Elements used in an SQL Command
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied param
- 7.5 High severity
Appointment Booking Calendar — Simply Schedule…: Missing Authorization
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_no
- 7.5 High severity
Appointment Booking Calendar — Simply Schedule…: Improper Neutralization of Special Elements used in an SQL Command
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class
- 7.5 High severity
Appointment Booking Calendar — Simply Schedule…: Improper Neutralization of Special Elements used in an SQL Command
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and including, 1.6.9.9 due to insufficient escapin
- 7.3 High severity
Appointment Booking Calendar — Simply Schedule…: Improper Control of Generation of Code
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action th
- 8.8 High severity
Appointment Booking Calendar — Simply Schedule…: Improper Neutralization of Special Elements used in an SQL Command
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied par