Stored Cross-Site Scripting Vulnerability in Simply Schedule Appointments Booking Plugin for WordPress
CVE-2025-4667
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 June 2025
What is CVE-2025-4667?
The Simply Schedule Appointments Booking Plugin for WordPress is susceptible to Stored Cross-Site Scripting. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes within the plugin's ssa_admin_upcoming_appointments and ssa_past_appointments shortcodes. Authenticated attackers with contributor-level access can leverage this weakness to inject arbitrary web scripts. Such scripts will execute when users visit the affected pages, potentially exposing sensitive information and compromising site integrity.
Affected Version(s)
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin * <= 1.6.8.30