Stored Cross-Site Scripting in SuperSaaS Appointment Scheduling Plugin for WordPress

CVE-2025-0862

What is CVE-2025-0862?

The SuperSaaS Appointment Scheduling Plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through the 'after' parameter in all versions up to and including 2.1.12. Due to inadequate input sanitization and output escaping, authenticated attackers with Contributor-level access can inject arbitrary web scripts into pages. These scripts execute whenever users visit an affected page, posing a risk especially to users operating on Chromium-based browsers such as Chrome, Edge, and Brave.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References