Vulnerabilities / Simply Schedule Appointments / WPSEC-2026-2884
Simply Schedule Appointments <= 1.6.13.0 - Unauthenticated Stored Cross-Site Scripting via Support Page Appointment Diagnostic
Medium 4.7
CWE-79Fixed in 1.6.13.4
- ID
- WPSEC-2026-2884
- Plugin
- Simply Schedule Appointments (simply-schedule-appointments)
- Affected
- all versions before 1.6.13.4
- Remediation
- Update to 1.6.13.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Simply Schedule Appointments on WPSec AttackSurface
- Fix released
- Published
Description
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Fix appointment durations' support diagnostic in all versions up to, and including, 1.6.13.0, due to the 'payment_method', 'customer_timezone' and 'customer_locale' booking fields being stored without sanitization and the diagnostic printing appointment rows without output escaping. This makes it possible for unauthenticated attackers who submit a booking to inject arbitrary web scripts that execute when an administrator runs the diagnostic and the affected appointment is printed to the page.
References
- https://wpsec.com/vuln/WPSEC-2026-2884/
- https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.13.4/
- https://wordpress.org/plugins/simply-schedule-appointments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS