VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Simply Schedule Appointments security & vulnerabilities

simply-schedule-appointments— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 52 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
52Known vulnerabilities
  • Critical0
  • High19
  • Medium33
  • Low0
Vulnerabilities per year
2022: 2 vulnerabilities2222023: 1 vulnerability1232024: 8 vulnerabilities8242025: 4 vulnerabilities4252026: 37 vulnerabilities3726

All Simply Schedule Appointments vulnerabilities

Simply Schedule Appointments vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Missing Authorization
≤1.6.13.0Update to 1.6.13.4
CVE-2026-125437
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.35Update to 1.6.12.37
CVE-2026-110382
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
≤1.6.12.35Update to 1.6.12.37
CVE-2026-110381
High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
≤1.6.12.35Update to 1.6.12.37
CVE-2026-104000
Medium5.3Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
≤1.6.11.11Update to 1.6.12.0
CVE-2026-6723
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
≤1.6.12.31Update to 1.6.12.33
CVE-2026-91109
High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
≤1.6.12.32Update to 1.6.12.33
CVE-2026-92245
High7.5Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
≤1.6.12.27Update to 1.6.12.33
CVE-2026-89294
Medium5.3Missing Authorization
≤1.6.12.29Update to 1.6.12.31
CVE-2026-94074
Medium5.3Unauthenticated Insecure Direct Object Reference
≤1.6.12.31Update to 1.6.12.33
CVE-2026-94673
Medium4.3Cross-Site Request Forgery
≤1.6.12.23Update to 1.6.12.24
CVE-2026-84764
Medium6.5Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
≤1.6.12.10Update to 1.6.12.11
CVE-2026-13358
Medium4.3Authenticated (Team Member+) Information Exposure
≤1.6.12.16Update to 1.6.12.17
CVE-2026-16541
Medium5.3Unauthenticated Insecure Direct Object Reference
<1.6.12.6Update to 1.6.12.6
CVE-2026-16540
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.10Update to 1.6.12.11
CVE-2026-65513
High7.5Unauthenticated SQL Injection
≤1.6.12.10Update to 1.6.12.11
CVE-2026-65508
Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Data Disclosure
≤1.6.12.10Update to 1.6.12.11
CVE-2026-15254
Medium5.3Missing Authorization
≤1.6.11.11Update to 1.6.12.0
CVE-2026-59523
Medium5.3Missing Authorization
≤1.6.12.4Update to 1.6.12.6
CVE-2026-57812
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.3Update to 1.6.12.4
CVE-2026-13400
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.2Update to 1.6.12.4
CVE-2026-57317
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.10.6Update to 1.6.11.0
CVE-2026-39447
Medium5.3Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint
≤1.6.11.8Update to 1.6.11.9
CVE-2026-6937
High7.5Unauthenticated SQL Injection via 'append_where_sql' Parameter
≤1.6.11.8Update to 1.6.11.9
CVE-2026-7797
Medium5.3Unauthenticated Denial of Service
≤1.6.11.5Update to 1.6.11.7
CVE-2026-7493
Medium6.5Unauthenticated Arbitrary Appointment View, Modification and Deletion
≤1.6.10.6Update to 1.6.11
CVE-2026-4807
Medium5.3Unauthenticated Sensitive Information Exposure
<1.6.11.2Update to 1.6.11.2
CVE-2026-42384
High7.5Unauthenticated SQL Injection
≤1.6.9.27Update to 1.6.9.29
CVE-2026-39493
Medium6.5Authenticated (Contributor+) SQL Injection
≤1.6.9.27Update to 1.6.9.29
CVE-2026-39495
High7.5Unauthenticated SQL Injection via 'fields' Parameter
≤1.6.10.0Update to 1.6.10.2
CVE-2026-3658
High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
≤1.6.9.29Update to 1.6.10.0
CVE-2026-3045
Medium4.3Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
≤1.6.9.29Update to 1.6.10.0
CVE-2026-1704
High7.5Unauthenticated SQL Injection via 'append_where_sql' Parameter
≤1.6.9.27Update to 1.6.9.29
CVE-2026-1708
Medium5.3Missing Authorization
≤1.6.11.0Update to 1.6.11.1
CVE-2026-39694
Medium5.3Missing Authorization
≤1.6.9.15Update to 1.6.9.17
CVE-2025-69315
High7.5Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
≤1.6.9.9Update to 1.6.9.13
CVE-2025-12166
Medium6.5Unauthenticated Sensitive Information Exposure
≤1.6.9.5Update to 1.6.9.6
CVE-2025-11723
Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure
≤1.6.9.16Update to 1.6.9.17
CVE-2025-13754
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
≤1.6.8.30Update to 1.6.8.32
CVE-2025-4667
High7.3Unauthenticated Arbitrary Shortcode Execution
≤1.6.8.5Update to 1.6.8.7
CVE-2025-1119
Medium6.1Reflected Cross-Site Scripting
≤1.6.8.3Update to 1.6.8.5
CVE-2024-13431
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings
≤1.6.7.53Update to 1.6.7.55
CVE-2024-7876
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Notification Settings
≤1.6.7.53Update to 1.6.7.55
CVE-2024-7877
High7.2Authenticated (Admin+) Remote Code Execution
≤1.6.7.42Update to 1.6.7.43
CVE-2024-7129
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.7.14Update to 1.6.7.18
CVE-2024-4288
Medium6.1Reflected Cross-Site Scripting
≤1.6.6.20Update to 1.6.6.24
CVE-2024-22311
High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤1.6.7.7Update to 1.6.7.9
CVE-2024-2342
High8.8Authenticated (Subscriber+) SQL Injection
≤1.6.7.7Update to 1.6.7.9
CVE-2024-2341
Medium4.3Cross-Site Request Forgery to Plugin Data Reset
≤1.6.6.20Update to 1.6.6.24
CVE-2024-1760
Medium6.6Authenticated(Administrator+) SQL Injection
<1.6.6.1Update to 1.6.6.1
CVE-2023-50851
Medium5.3Unauthenticated Sensitive Information Exposure
≤1.5.7.5Update to 1.5.7.7
CVE-2022-2373
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
≤1.5.7.5Update to 1.5.7.7
CVE-2022-2374

Simply Schedule Appointments: common questions

Does Simply Schedule Appointments have known vulnerabilities?

Yes. VulnCrest Radar lists 52 known vulnerabilities in Simply Schedule Appointments: 19 high, 33 medium. None are known to affect version null.

How do I check which version of Simply Schedule Appointments I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Simply Schedule Appointments vulnerability?

CVE-2026-125437, published Nov 11, 2026: Simply Schedule Appointments <= 1.6.13.0 - Missing Authorization. Severity: Medium (CVSS 5.3).

Is any Simply Schedule Appointments vulnerability listed in CISA KEV?

No. None of the known Simply Schedule Appointments vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?