CVE-2026-110382: WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/simply-schedule-appointmentsto a version that resolves this vulnerability.Fixed in 1.6.12.37
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that the vulnerability is remotely reachable, requires no privileges, has low attack complexity, and requires user interaction. Exploitation involves causing a user to interact with attacker-controlled stored content that is rendered by the affected plugin.
Which installations are affected?
Simply Schedule Appointments versions through 1.6.12.35 are affected. The available data does not identify a fixed version or any configuration requirement.
What is the potential impact?
This is a stored XSS issue with scope changed and low confidentiality, integrity, and availability impacts. Successful exploitation could allow script execution in the context of a user viewing the affected content.