Ccroixhaug

Products

Exploited and recent CVEs

• CVE-2026-104000 High 7.2 Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} 0.2%
• CVE-2026-6723 Medium 5.3 Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token 0.2%
• CVE-2026-91109 Medium 6.5 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter 0.3%
• CVE-2026-92245 High 7.5 Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce 0.4%
• CVE-2026-89294 High 7.5 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter 1.0%
• CVE-2026-13358 Medium 6.5 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure 0.7%
• CVE-2026-6937 Medium 5.3 Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint 0.6%
• CVE-2026-7797 High 7.5 Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter 0.6%
• CVE-2026-7493 Medium 5.3 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service 0.4%
• CVE-2026-4807 Medium 6.5 Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion 0.5%
• CVE-2026-3658 High 7.5 Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter 0.3%
• CVE-2026-1704 Medium 4.3 Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure 0.2%
• CVE-2026-3045 High 7.5 Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint 0.3%
• CVE-2026-1708 High 7.5 Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter 0.5%
• CVE-2025-12166 High 7.5 Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters 0.3%
• CVE-2025-11723 Medium 6.5 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure 0.2%
• CVE-2025-13754 Medium 5.3 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure 0.3%
• CVE-2025-4667 Medium 6.4 Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes 0.3%
• CVE-2025-1119 High 7.3 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution 0.5%
• CVE-2024-13431 Medium 6.1 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting 0.4%
• CVE-2024-4288 Medium 6.4 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-2341 High 8.8 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection 0.6%
• CVE-2024-2342 High 8.8 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode 0.6%
• CVE-2024-1760 Medium 4.3 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset 0.3%
• CVE-2023-2764 Medium 4.3 Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification 0.5%