6.5
Moyenne
CVE-2026-15254 The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an…
Description
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simply Schedule Appointments 1.6 | premières → < 1.6.12.11 | 1.6.12.11 |
Autres CVE de Simply Schedule Appointments
Les 4 CVE de Simply Schedule Appointments →
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some…
6.5
Moyenne
CVE-2026-16540
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment…
7.5
Élevée
CVE-2026-13400
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and…
6.1
Moyenne