Advisories · Technology
Easy Appointments.
Every CVE that names Easy Appointments among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
- Easy Appointments
- Broken access control
- CVSS 4.8 Medium
Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token
- Easy Appointments
- Broken access control
- CVSS 7.1 High
WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
- Easy Appointments
- Cross-site scripting (XSS)
- CVSS 2.7 Low
Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing
- Easy Appointments
- Information disclosure
- CVSS 2.7 Low
Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass
- Easy Appointments
- CWE-20
- CVSS 4.3 Medium
Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing
- Easy Appointments
- Information disclosure
- CVSS 4.3 Medium
Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR
- Easy Appointments
- Broken access control
- CVSS 3.8 Low
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
- Easy Appointments
- Broken access control
- CVSS 3.8 Low
Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
- Easy Appointments
- Broken access control
- CVSS 2.7 Low
Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure
- Easy Appointments
- Information disclosure
- CVSS 5.4 Medium
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
- Easy Appointments
- Broken access control
- CVSS 6.5 Medium
WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability
- Easy Appointments
- Broken access control
- CVSS 7.5 High
WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability
- Easy Appointments
- Broken access control
- CVSS 6.5 Medium
WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability
- Easy Appointments
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode
- Easy Appointments