Simply Schedule Appointments
NSquared
Developer
1.6.12.33
Latest version
50,000
Installations
No date
Last updated
Vulnerability history
0 present
43 patched
22 Mitigation rules
- Insecure Direct Object References (IDOR) vulnerability<= 1.6.12.315 hours ago
- Cross Site Request Forgery (CSRF) vulnerability<= 1.6.12.2302/09/2026
- Contributor+ Sensitive Data Disclosure via Admin Shortcode vulnerability< 1.6.12.1125/08/2026
- WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability<= 1.6.12.1018/08/2026
- Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability< 1.6.12.1718/08/2026
- Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability< 1.6.12.606/08/2026
- Unauthenticated Stored XSS vulnerability< 1.6.12.429/07/2026
- Cross Site Scripting (XSS) vulnerability<= 1.6.12.1028/07/2026
- SQL Injection vulnerability<= 1.6.12.1028/07/2026
- Broken Access Control vulnerability<= 1.6.12.409/07/2026
- Broken Access Control vulnerability<= 1.6.11.1109/07/2026
- Cross Site Scripting (XSS) vulnerability<= 1.6.12.226/06/2026
- Cross Site Scripting (XSS) vulnerability<= 1.6.10.628/05/2026
- Unauthenticated SQL Injection vulnerability<= 1.6.11.828/05/2026
- Missing Authorization to Unauthenticated Arbitrary Modification vulnerability<= 1.6.11.827/05/2026
- Unauthenticated Denial of Service vulnerability<= 1.6.11.526/05/2026
- Unauthenticated Arbitrary Appointment View, Modification and Deletion vulnerability<= 1.6.10.607/05/2026
- Sensitive Data Exposure vulnerability< 1.6.11.227/04/2026
- SQL Injection vulnerability<= 1.6.9.2708/04/2026
- SQL Injection vulnerability<= 1.6.9.2726/03/2026
- Unauthenticated SQL Injection via 'fields' Parameter vulnerability<= 1.6.10.020/03/2026
- Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint vulnerability<= 1.6.9.2913/03/2026
- Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure vulnerability<= 1.6.9.2913/03/2026
- Unauthenticated SQL Injection via 'append_where_sql' Parameter vulnerability<= 1.6.9.2711/03/2026
- Broken Access Control vulnerability<= 1.6.11.026/02/2026
- Broken Access Control vulnerability<= 1.6.9.1520/01/2026
- Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters vulnerability<= 1.6.9.915/01/2026
- Unauthenticated Sensitive Information Exposure vulnerability<= 1.6.9.506/01/2026
- Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability<= 1.6.9.1618/12/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability<= 1.6.8.3017/06/2025
- Unauthenticated Arbitrary Shortcode Execution vulnerability<= 1.6.8.512/03/2025
- Reflected Cross-Site Scripting vulnerability<= 1.6.8.306/03/2025
- Authenticated (Admin+) Stored Cross-Site Scripting vulnerability<= 1.6.7.5315/10/2024
- Authenticated (Admin+) Stored Cross-Site Scripting vulnerability<= 1.6.7.5315/10/2024
- Admin+ Template Injection to RCE vulnerability< 1.6.7.4313/09/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 1.6.7.1416/05/2024
- Reflected Cross Site Scripting (XSS) vulnerability<= 1.6.6.2026/03/2024
- Authenticated (Contributor+) SQL Injection via Shortcode vulnerability<= 1.6.7.721/03/2024
- Authenticated (Subscriber+) SQL Injection vulnerability<= 1.6.7.721/03/2024
- Cross-Site Request Forgery to Plugin Data Reset vulnerability<= 1.6.6.2006/03/2024
- SQL Injection vulnerability< 1.6.6.121/12/2023
- Authenticated Stored Cross-Site Scripting (XSS) vulnerability<= 1.5.7.608/08/2022
- Unauthenticated Email Address Disclosure vulnerability<= 1.5.7.608/08/2022