Stored Cross-Site Scripting Vulnerability in Simply Schedule Appointments Booking Plugin for WordPress

CVE-2025-4667

What is CVE-2025-4667?

The Simply Schedule Appointments Booking Plugin for WordPress is susceptible to Stored Cross-Site Scripting. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes within the plugin's ssa_admin_upcoming_appointments and ssa_past_appointments shortcodes. Authenticated attackers with contributor-level access can leverage this weakness to inject arbitrary web scripts. Such scripts will execute when users visit the affected pages, potentially exposing sensitive information and compromising site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References