Advisories · Technology
croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.
Every CVE that names croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Broken access control
- CVSS 7.5 High
Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 5.3 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Denial of service
- CVSS 6.5 Medium
Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Broken access control
- CVSS 7.5 High
Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 4.3 Medium
Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Broken access control
- CVSS 7.5 High
Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Broken access control
- CVSS 7.5 High
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 7.5 High
Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 6.5 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Weak cryptography or TLS
- CVSS 5.3 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Broken access control
- CVSS 6.4 Medium
Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Cross-site scripting (XSS)
- CVSS 7.3 High
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Code injection
- CVSS 6.1 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Cross-site scripting (XSS)
- CVSS 8.8 High
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 8.8 High
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 4.3 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Cross-site request forgery (CSRF)