Stored Cross-Site Scripting Vulnerability in Simply Schedule Appointments Plugin for WordPress
CVE-2026-104000

7.2HIGH

Key Information:

Vendor

WordPress
Status
Simply Schedule Appointments
Vendor
CVE Published:
16 October 2026

What is CVE-2026-104000?

The Simply Schedule Appointments plugin for WordPress presents a vulnerability that allows Stored Cross-Site Scripting through the 'status' parameter. This issue arises from inadequate input sanitization and output escaping, affecting all versions up to and including 1.6.12.35. Attackers can inject malicious scripts that execute when users access the impacted pages. This risk is exacerbated by the default enabling of debug logging, making the debug-log viewer accessible to anyone holding the site-wide Support PIN. Consequently, this enables unauthorized execution of scripts against an administrator's session during routine support or troubleshooting activities.

Affected Version(s)

Simply Schedule Appointments 0 <= 1.6.12.35

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simply-schedul...
https://plugins.trac.wordpress.org/browser/simply-schedul...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kuba
.