6.5
Moyenne
CVE-2026-16541 The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some…
Description
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simply Schedule Appointments 1.6 | premières → < 1.6.12.17 | 1.6.12.17 |
Autres CVE de Simply Schedule Appointments
Les 4 CVE de Simply Schedule Appointments →
CVE-2026-15254
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an…
6.5
Moyenne
CVE-2026-16540
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment…
7.5
Élevée
CVE-2026-13400
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and…
6.1
Moyenne