6.1
Medium
CVE-2026-13400 Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and…
Description
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simply Schedule Appointments 1.6 | earliest → < 1.6.12.4 | 1.6.12.4 |
Other CVEs of Simply Schedule Appointments
The 4 CVEs of Simply Schedule Appointments →
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some…
6.5
Medium
CVE-2026-15254
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an…
6.5
Medium
CVE-2026-16540
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment…
7.5
High