What’s Vulnerable › Products

Easy Appointments vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your Easy Appointments version is affected

Latest Easy Appointments vulnerabilities

• CVE-2026-9232 — Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action (CVSS 6.5)
• CVE-2026-87966 — Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR (CVSS 5.3)
• CVE-2026-87965 — Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token (CVSS 4.8)
• CVE-2026-19406 — Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing (CVSS 2.7)
• CVE-2026-14225 — Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass (CVSS 2.7)
• CVE-2026-14226 — Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing (CVSS 4.3)
• CVE-2026-14223 — Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR (CVSS 4.3)
• CVE-2026-14222 — Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization (CVSS 3.8)
• CVE-2026-14221 — Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization (CVSS 3.8)
• CVE-2026-14188 — Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure (CVSS 2.7)
• CVE-2026-14224 — Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR (CVSS 5.4)
• CVE-2026-8789 — Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion (CVSS 8.1)
• CVE-2026-11992 — Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation (CVSS 4.3)
• CVE-2026-2262 — Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API (CVSS 7.5)
• CVE-2023-30748 — WordPress Easy Appointments plugin <= 3.10.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-2844 — Easy Appointments <= 3.11.18 - Insufficient Authorization (CVSS 4.3)
• CVE-2024-2842 — Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2022-36424 — WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
• CVE-2022-4668 — Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode (CVSS 5.4)
• CVE-2017-15812 — (CVSS 6.1)