Stored Cross-Site Scripting Vulnerability in Simply Schedule Appointments Plugin for WordPress
CVE-2026-13400
What is CVE-2026-13400?
The Simply Schedule Appointments WordPress plugin contains a vulnerability that allows unauthenticated attackers to inject malicious scripts into the notification content field. This is due to a failure in proper sanitization, where a double-encoded payload bypasses filters and is executed when the notification is rendered. All versions prior to 1.6.12.4 are affected, exposing users to potential data theft or site compromise. The vulnerability arises from a defect in sanitization-ordering that permits harmful content to escape filtering processes.
Affected Version(s)
Simply Schedule Appointments 0 < 1.6.12.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.