5.4
Moyenne
CVE-2022-4668 The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes…
Description
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Easy Appointments 3.11 | premières → < 3.11.2 | 3.11.2 |
Autres CVE de Easy Appointments
Les 11 CVE de Easy Appointments →
CVE-2026-87965
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link…
4.8
Moyenne
CVE-2026-87966
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its…
5.3
Moyenne
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to…
2.7
Faible
CVE-2026-14225
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its…
2.7
Faible