Plugin icon

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

simply-schedule-appointments

Vulnerabilities:

27

Last Updated:

May 12, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-05-06
Title
Appointment Booking Calendar < 1.6.11 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
Fixed in
Fixed in 1.6.11
CVSS
6.5 (medium)
Published
2026-04-27
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.11.2 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 1.6.11.2
CVSS
5.3 (medium)
Published
2026-04-08
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.9.29 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.6.9.29
CVSS
7.5 (high)
Published
2026-03-26
Title
Simply Schedule Appointments < 1.6.9.29 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 1.6.9.29
CVSS
4.9 (medium)
Published
2026-03-18
Title
Appointment Booking Calendar < 1.6.10.2 - Unauthenticated SQL Injection via 'fields' Parameter
Fixed in
Fixed in 1.6.10.2
CVSS
7.5 (high)
Published
2026-03-12
Title
Appointment Booking Calendar < 1.6.10.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
Fixed in
Fixed in 1.6.10.0
CVSS
7.5 (high)
Published
2026-03-12
Title
Appointment Booking Calendar < 1.6.10.0 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
Fixed in
Fixed in 1.6.10.0
CVSS
4.3 (medium)
Published
2026-03-10
Title
Appointment Booking Calendar < 1.6.9.29 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Fixed in
Fixed in 1.6.9.29
CVSS
7.5 (high)
Published
2026-02-26
Title
Simply Schedule Appointments < 1.6.11.1 - Missing Authorization
Fixed in
Fixed in 1.6.11.1
CVSS
5.3 (medium)
Published
2026-01-20
Title
Simply Schedule Appointments < 1.6.9.17 - Missing Authorization
Fixed in
Fixed in 1.6.9.17
CVSS
5.3 (medium)
Published
2026-01-14
Title
Simply Schedule Appointments < 1.6.9.13 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
Fixed in
Fixed in 1.6.9.13
CVSS
7.5 (high)
Published
2026-01-05
Title
Appointment Booking Calendar < 1.6.9.6 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 1.6.9.6
CVSS
4.8 (medium)
Published
2025-12-18
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.9.17 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 1.6.9.17
CVSS
5.3 (medium)
Published
2025-06-13
Title
Simply Schedule Appointments < 1.6.8.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Fixed in
Fixed in 1.6.8.32
CVSS
6.4 (medium)
Published
2025-03-12
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.8.7 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 1.6.8.7
CVSS
7.3 (high)
Published
2025-03-06
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.8.5 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.6.8.5
CVSS
6.1 (medium)
Published
2024-10-15
Title
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
Fixed in
Fixed in 1.6.7.55
CVSS
3.5 (low)
Published
2024-10-15
Title
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
Fixed in
Fixed in 1.6.7.55
CVSS
3.5 (low)
Published
2024-08-23
Title
Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
Fixed in
Fixed in 1.6.7.43
CVSS
6.6 (medium)
Published
2024-05-15
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.6.7.18
CVSS
6.4 (medium)
Published
2024-03-26
Title
Simply Schedule Appointments < 1.6.6.24 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.6.6.24
CVSS
6.1 (medium)
Published
2024-03-20
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.7.9 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.6.7.9
CVSS
8.8 (high)
Published
2024-03-20
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.7.9 - Authenticated (Contributor+) SQL Injection via Shortcode
Fixed in
Fixed in 1.6.7.9
CVSS
8.8 (high)
Published
2024-03-05
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.6.24 - Cross-Site Request Forgery to Plugin Data Reset
Fixed in
Fixed in 1.6.6.24
CVSS
4.3 (medium)
Published
2023-12-21
Title
Simply Schedule Appointments < 1.6.6.1 - Authenticated(Administrator+) SQL Injection
Fixed in
Fixed in 1.6.6.1
CVSS
6.6 (medium)
Published
2022-08-08
Title
Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure
Fixed in
Fixed in 1.5.7.7
CVSS
5.3 (medium)
Published
2022-08-08
Title
Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.7.7
CVSS
3.4 (low)