alextselegidis Easy!Appointments

• CVE-2026-108758 High 8.2 Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint 0.3%
• CVE-2026-55651 High 7.1 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure 0.2%
• CVE-2026-52841 Low 3.1 Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync 0.2%
• CVE-2026-52840 Low 2.7 Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network 0.2%
• CVE-2026-52839 Low 3.3 Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass 0.2%
• CVE-2026-52838 Low 2.6 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS 0.2%
• CVE-2026-52837 Medium 6.9 Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page 0.5%
• CVE-2026-23622 High 7.4 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover 0.2%
• CVE-2025-31828 Medium 4.3 WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability 0.3%
• CVE-2024-0698 Medium 6.4 Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%