Simply Schedule Appointments vulnerabilities

3 known vulnerabilities in Simply Schedule Appointments from Croixhaug. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Simply Schedule Appointments: Improper Neutralization of Input During Web Page Generation

  CVE-2026-104000Oct 16, 2026Croixhaug

  The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for

• 7.5 High severity

  Simply Schedule Appointments: Missing Authorization

  CVE-2026-92245Oct 1, 2026Croixhaug

  The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII —

• 7.5 High severity

  Simply Schedule Appointments: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2026-89294Sep 30, 2026Croixhaug

  The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level acce