tenteeglobal vulnerabilities

Products

• Instant Appointment 3

Latest tenteeglobal CVEs

Newest publication first

1. CVE-2026-15282 Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload

   Published 2026-07-10

   Critical·CVSS 9.8 EPSS 1.1%

   The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload a...

2. CVE-2025-23672 WordPress Instant Appointment plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-01-22

   High·CVSS 7.1 EPSS 0.39%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal Instant Appointment instant-appointment allows Reflected XSS.This issue affects Instant Appointment: from n/a through <= 1.2.

3. CVE-2024-54361 WordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerability

   Published 2024-12-16

   Critical·CVSS 9.3 EPSS 0.54%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allows SQL Injection.This issue affects Instant Appointment: from n/a through <= 1.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.