Stored Cross-Site Scripting in SuperSaaS Appointment Scheduling Plugin for WordPress
CVE-2025-0862
4.9MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 February 2025
What is CVE-2025-0862?
The SuperSaaS Appointment Scheduling Plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through the 'after' parameter in all versions up to and including 2.1.12. Due to inadequate input sanitization and output escaping, authenticated attackers with Contributor-level access can inject arbitrary web scripts into pages. These scripts execute whenever users visit an affected page, posing a risk especially to users operating on Chromium-based browsers such as Chrome, Edge, and Brave.
Affected Version(s)
SuperSaaS – online appointment scheduling * <= 2.1.12