Cross-Site Scripting Vulnerability in Simply Schedule Appointments by Simply Schedule

CVE-2026-65513

What is CVE-2026-65513?

An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Simply Schedule Appointments plugin for WordPress, affecting versions up to 1.6.12.10. This vulnerability allows attackers to inject malicious scripts into the application, which can be executed in the context of an unsuspecting user’s session. By exploiting this flaw, attackers could potentially carry out attacks such as data theft, session hijacking, or redirecting users to malicious websites. It is crucial for users of the affected plugin to apply security updates and monitor their installations to mitigate potential risks.

References