Plugin icon

Easy Appointments

easy-appointments

Vulnerabilities:

23

Last Updated:

October 5, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-09-18
Title
Easy Appointments < 3.12.28 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Fixed in
Fixed in 3.12.28
CVSS
4.9 (medium)
Published
2026-09-16
Title
Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token
Fixed in
Fixed in 4.0.2.2
CVSS
4.8 (medium)
Published
2026-09-16
Title
Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
Fixed in
Fixed in 4.0.2.2
CVSS
5.3 (medium)
Published
2026-09-07
Title
Easy Appointments <= 4.0.2.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
7.2 (high)
Published
2026-08-17
Title
Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing
Fixed in
Fixed in 4.0.1
CVSS
2.7 (low)
Published
2026-07-23
Title
Easy Appointments < 3.12.28 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
Fixed in
Fixed in 3.12.28
CVSS
6.5 (medium)
Published
2026-07-16
Title
Easy Appointments < 3.12.28 - Unauthenticated Insecure Direct Object Reference
Fixed in
Fixed in 3.12.28
CVSS
5.3 (medium)
Published
2026-07-09
Title
Easy Appointments < 3.12.28 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
Fixed in
Fixed in 3.12.28
CVSS
2.7 (low)
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing
Fixed in
Fixed in 3.12.28
CVSS
4.3 (medium)
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass
Fixed in
Fixed in 3.12.28
CVSS
2.7 (low)
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR
Fixed in
Fixed in 3.12.28
CVSS
4.3 (medium)
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
Fixed in
Fixed in 3.12.28
CVSS
3.8 (low)
Published
2026-07-08
Title
Easy Appointments < 4.0.1 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
Fixed in
Fixed in 4.0.1
CVSS
3.8 (low)
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure
Fixed in
Fixed in 3.12.28
CVSS
3.1 (low)
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
Fixed in
Fixed in 3.12.28
CVSS
5.4 (medium)
Published
2026-04-17
Title
Easy Appointments < 3.12.22 - Unauthenticated Sensitive Information Exposure via REST API
Fixed in
Fixed in 3.12.22
CVSS
7.5 (high)
Published
2026-04-13
Title
Easy Appointments < 3.12.22 - Missing Authorization
Fixed in
Fixed in 3.12.22
CVSS
5.3 (medium)
Published
2025-09-09
Title
Easy Appointments < 3.12.14.1 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 3.12.14.1
CVSS
6.5 (medium)
Published
2024-03-28
Title
Easy Appointments < 3.11.19 - Insufficient Authorization
Fixed in
Fixed in 3.11.19
CVSS
4.3 (medium)
Published
2024-03-28
Title
Easy Appointments < 3.11.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.11.19
CVSS
6.4 (medium)
Published
2023-05-05
Title
Easy Appointments < 3.11.10 - Cross-Site Request Forgery
Fixed in
Fixed in 3.11.10
CVSS
4.3 (medium)
Published
2022-12-27
Title
Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode
Fixed in
Fixed in 3.11.2
CVSS
6.8 (medium)
Published
2017-10-16
Title
Easy Appointments < 1.12.0 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.12.0
CVSS
6.1 (medium)