Advisories · Technology
croixhaug Simply Schedule Appointments.
Every CVE that names croixhaug Simply Schedule Appointments among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
- croixhaug Simply Schedule Appointments
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
- croixhaug Simply Schedule Appointments
- Broken access control
- CVSS 6.5 Medium
Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
- croixhaug Simply Schedule Appointments
- Broken access control
- CVSS 7.5 High
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_typ…
- croixhaug Simply Schedule Appointments
- Broken access control
- CVSS 7.5 High
Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
- croixhaug Simply Schedule Appointments
- File inclusion
- CVSS 6.5 Medium
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
- croixhaug Simply Schedule Appointments
- Broken access control