croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin vulnerabilities

39 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 35 published in the last 12 months.

Check whether your croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin version is affected

Latest croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin vulnerabilities

CVE-2026-110382 — WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-104000 — Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} (CVSS 7.2)
CVE-2026-110381 — WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.3)
CVE-2026-6723 — Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token (CVSS 5.3)
CVE-2026-92245 — Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce (CVSS 7.5)
CVE-2026-91109 — Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter (CVSS 6.5)
CVE-2026-94673 — WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
CVE-2026-94074 — WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability (CVSS 6.5)
CVE-2026-89294 — Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter (CVSS 7.5)
CVE-2026-84764 — WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
CVE-2026-13358 — Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 6.5)
CVE-2026-65513 — WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-65508 — WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability (CVSS 9.3)
CVE-2026-59523 — WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability (CVSS 6.5)
CVE-2026-57812 — WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability (CVSS 6.5)
CVE-2026-57317 — WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-42384 — WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability (CVSS 7.5)
CVE-2026-39493 — WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability (CVSS 9.3)
CVE-2026-39447 — WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-6937 — Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint (CVSS 5.3)
CVE-2026-7797 — Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter (CVSS 7.5)
CVE-2026-7493 — Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service (CVSS 5.3)
CVE-2026-4807 — Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion (CVSS 6.5)
CVE-2026-39694 — WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2026-39495 — WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability (CVSS 8.5)