WordPress plugin
Simply Schedule Appointments security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 52 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High19
- Medium33
- Low0
All Simply Schedule Appointments vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.35Update to 1.6.12.37
- High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
≤1.6.12.35Update to 1.6.12.37
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
≤1.6.12.32Update to 1.6.12.33
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
≤1.6.12.27Update to 1.6.12.33
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.10Update to 1.6.12.11
- High7.5Unauthenticated SQL Injection
≤1.6.12.10Update to 1.6.12.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.3Update to 1.6.12.4
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.12.2Update to 1.6.12.4
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.10.6Update to 1.6.11.0
- High7.5Unauthenticated SQL Injection via 'append_where_sql' Parameter
≤1.6.11.8Update to 1.6.11.9
- High7.5Unauthenticated SQL Injection
≤1.6.9.27Update to 1.6.9.29
- High7.5Unauthenticated SQL Injection via 'fields' Parameter
≤1.6.10.0Update to 1.6.10.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
≤1.6.9.29Update to 1.6.10.0
- High7.5Unauthenticated SQL Injection via 'append_where_sql' Parameter
≤1.6.9.27Update to 1.6.9.29
- High7.5Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
≤1.6.9.9Update to 1.6.9.13
- High7.3Unauthenticated Arbitrary Shortcode Execution
≤1.6.8.5Update to 1.6.8.7
- High7.2Authenticated (Admin+) Remote Code Execution
≤1.6.7.42Update to 1.6.7.43
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤1.6.7.7Update to 1.6.7.9
- High8.8Authenticated (Subscriber+) SQL Injection
≤1.6.7.7Update to 1.6.7.9
Simply Schedule Appointments: common questions
Does Simply Schedule Appointments have known vulnerabilities?
Yes. VulnCrest Radar lists 52 known vulnerabilities in Simply Schedule Appointments: 19 high, 33 medium. None are known to affect version null.
How do I check which version of Simply Schedule Appointments I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Simply Schedule Appointments vulnerability?
CVE-2026-125437, published Nov 11, 2026: Simply Schedule Appointments <= 1.6.13.0 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Simply Schedule Appointments vulnerability listed in CISA KEV?
No. None of the known Simply Schedule Appointments vulnerabilities is currently listed in the CISA KEV catalog.