# croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. Every CVE that names croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint](https://agentprime.io/advisories/CVE-2026-6937.md) `CVE-2026-6937` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Broken access control - [Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter](https://agentprime.io/advisories/CVE-2026-7797.md) `CVE-2026-7797` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.5 High · Not analysed yet · Published 28 May 2026 · Tags: SQL injection - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-7493.md) `CVE-2026-7493` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Denial of service - [Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion](https://agentprime.io/advisories/CVE-2026-4807.md) `CVE-2026-4807` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2026 · Tags: Broken access control - [Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter](https://agentprime.io/advisories/CVE-2026-3658.md) `CVE-2026-3658` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.5 High · Not analysed yet · Published 19 Mar 2026 · Tags: SQL injection - [Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2026-1704.md) `CVE-2026-1704` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 4.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Broken access control - [Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint](https://agentprime.io/advisories/CVE-2026-3045.md) `CVE-2026-3045` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: Broken access control - [Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter](https://agentprime.io/advisories/CVE-2026-1708.md) `CVE-2026-1708` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: SQL injection - [Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via \`order\` and \`append_where_sql\` Parameters](https://agentprime.io/advisories/CVE-2025-12166.md) `CVE-2025-12166` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.5 High · Not analysed yet · Published 14 Jan 2026 · Tags: SQL injection - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2025-11723.md) `CVE-2025-11723` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 6.5 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Weak cryptography or TLS - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2025-13754.md) `CVE-2025-13754` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 5.3 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Broken access control - [Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes](https://agentprime.io/advisories/CVE-2025-4667.md) `CVE-2025-4667` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 6.4 Medium · Not analysed yet · Published 14 Jun 2025 · Tags: Cross-site scripting (XSS) - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-1119.md) `CVE-2025-1119` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.3 High · Not analysed yet · Published 13 Mar 2025 · Tags: Code injection - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-13431.md) `CVE-2024-13431` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 6.1 Medium · Not analysed yet · Published 7 Mar 2025 · Tags: Cross-site scripting (XSS) - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-4288.md) `CVE-2024-4288` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 6.4 Medium · Not analysed yet · Published 16 May 2024 · Tags: Cross-site scripting (XSS) - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection](https://agentprime.io/advisories/CVE-2024-2341.md) `CVE-2024-2341` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 8.8 High · Not analysed yet · Published 9 Apr 2024 · Tags: SQL injection - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode](https://agentprime.io/advisories/CVE-2024-2342.md) `CVE-2024-2342` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 8.8 High · Not analysed yet · Published 9 Apr 2024 · Tags: SQL injection - [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset](https://agentprime.io/advisories/CVE-2024-1760.md) `CVE-2024-1760` · CVE record: croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site request forgery (CSRF) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .