CR
Vendor
croixhaug
18
CVEs
0
On KEV
5
New 30D
Products
SS7.5
Simply Schedule Appointments
croixhaug
6 CVEs0 on KEV5 new
AB7.5
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
croixhaug
12 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104000 | SS Simply Schedule Appointments croixhaug | 7.2 | Oct 16 | Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} |
| CVE-2026-6723 | SS Simply Schedule Appointments croixhaug | 5.3 | Oct 10 | Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token |
| CVE-2026-91109 | SS Simply Schedule Appointments croixhaug | 6.5 | Oct 1 | Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter |
| CVE-2026-92245 | SS Simply Schedule Appointments croixhaug | 7.5 | Oct 1 | Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce |
| CVE-2026-89294 | SS Simply Schedule Appointments croixhaug | 7.5 | Sep 30 | Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter |
| CVE-2026-13358 | SS Simply Schedule Appointments croixhaug | 6.5 | Aug 16 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure |
| CVE-2026-6937 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 5.3 | May 28 | Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint |
| CVE-2026-7797 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 7.5 | May 28 | Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter |
| CVE-2026-7493 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 5.3 | May 27 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service |
| CVE-2026-4807 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 6.5 | May 7 | Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion |
| CVE-2026-3658 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 7.5 | Mar 19 | Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter |
| CVE-2026-1704 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 4.3 | Mar 13 | Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure |
| CVE-2026-3045 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 7.5 | Mar 13 | Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint |
| CVE-2026-1708 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 7.5 | Mar 11 | Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter |
| CVE-2025-12166 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 7.5 | Jan 14 | Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters |
| CVE-2025-11723 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 6.5 | Jan 6 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure |
| CVE-2025-13754 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 5.3 | Dec 19 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2025-4667 | AB Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin croixhaug | 6.4 | Jun 14 | Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes |