# croixhaug Simply Schedule Appointments.

Every CVE that names croixhaug Simply Schedule Appointments among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}](https://agentprime.io/advisories/CVE-2026-104000.md)
  `CVE-2026-104000` · CVE record: croixhaug Simply Schedule Appointments · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token](https://agentprime.io/advisories/CVE-2026-6723.md)
  `CVE-2026-6723` · CVE record: croixhaug Simply Schedule Appointments · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter](https://agentprime.io/advisories/CVE-2026-91109.md)
  `CVE-2026-91109` · CVE record: croixhaug Simply Schedule Appointments · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_typ…](https://agentprime.io/advisories/CVE-2026-92245.md)
  `CVE-2026-92245` · CVE record: croixhaug Simply Schedule Appointments · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter](https://agentprime.io/advisories/CVE-2026-89294.md)
  `CVE-2026-89294` · CVE record: croixhaug Simply Schedule Appointments · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: File inclusion
- [Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2026-13358.md)
  `CVE-2026-13358` · CVE record: croixhaug Simply Schedule Appointments · CVSS 6.5 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=croixhaug-simply-schedule-appointments>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/croixhaug-simply-schedule-appointments/>. Everything for agents: <https://agentprime.io/llms.txt>.