Easy Appointments vulnerabilities

Products

• Easy Appointments 4

Latest Easy Appointments CVEs

Newest publication first

1. CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-08

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

2. CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-07-23

   Medium·CVSS 6.5 EPSS 0.33%

   Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

3. CVE-2026-39513 WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability

   Published 2026-06-15

   High·CVSS 7.5 EPSS 0.29%

   Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

4. CVE-2025-49398 WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability

   Published 2025-11-06

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Code Injection.This issue affects Easy Appointments: from n/a through <= 3.12.14.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.