6.1
Moyenne
CVE-2026-13400 Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and…
Description
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simply Schedule Appointments 1.6 | premières → < 1.6.12.4 | 1.6.12.4 |
Autres CVE de Simply Schedule Appointments
Les 4 CVE de Simply Schedule Appointments →
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some…
6.5
Moyenne
CVE-2026-15254
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an…
6.5
Moyenne
CVE-2026-16540
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment…
7.5
Élevée