croixhaug

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high20CVSS 7.0–8.9

Exploited now

croixhaug records in CISA KEV

No croixhaug vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Simply Schedule Appointments 4 records LOW Appointment Booking Calendar 1 record LOW

Records

44 records

TI-2026-46678 CVE-2026-65508 · GHSA-8prr-j8xh-jjcw

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-08-06 No fix listed CWE-89

TI-2026-28467 CVE-2026-39493 · GHSA-87gp-c4mf-v6pp

WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00363 Published 2026-06-15 No fix listed CWE-89

TI-2026-06865 CVE-2026-7797 · GHSA-8h7g-4m22-x8gv

Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter

MEDIUM 40

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'append_where_sql' parameter in all versions up to, and includin…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00554 Published 2026-05-28 No fix listed CWE-89

TI-2026-62275 CVE-2026-92245 · GHSA-3frh-27r2-gj5w

Missing authorization in croixhaug Simply Schedule Appointments

LOW 39

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00429 Published 2026-10-01 No fix listed CWE-862

TI-2026-58265 CVE-2026-84764 · GHSA-95h8-hr2w-h7f8

WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

LOW 39

Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00201 Published 2026-09-02 No fix listed CWE-352

TI-2026-30684 CVE-2026-42384 · GHSA-vxmf-3r42-mv9x

WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability

LOW 39

Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00294 Published 2026-06-15 Fixed in 1.6.11.2 CWE-201

TI-2026-03153 CVE-2026-3658 · GHSA-vx4w-426f-69qh

Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insuffic…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00323 Published 2026-03-19 No fix listed CWE-89

TI-2026-02629 CVE-2026-3045 · GHSA-4w38-6pqj-mw46

Missing authorization in croixhaug Appointment Booking Calendar — Simply Schedule…

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00308 Published 2026-03-13 No fix listed CWE-862

TI-2026-01391 CVE-2026-1708 · GHSA-g769-gg5q-p2w7

Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00462 Published 2026-03-11 No fix listed CWE-89

TI-2025-11154 CVE-2025-12166 · GHSA-rv9m-9xwv-6gcw

Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and includ…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00336 Published 2026-01-14 No fix listed CWE-89

TI-2025-00951 CVE-2025-1119 · GHSA-hq92-6qrm-cxxj

Code injection in croixhaug Appointment Booking Calendar — Simply Schedule Appointments…

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00549 Published 2025-03-13 No fix listed CWE-94

TI-2024-02177 CVE-2024-2342 · GHSA-mg9j-5xr7-3245

SQL injection in croixhaug Appointment Booking Calendar — Simply Schedule Appointments…

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insuff…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00594 Published 2024-04-09 No fix listed CWE-89

TI-2024-02176 CVE-2024-2341 · GHSA-5mr4-7p75-327r

SQL injection in croixhaug Appointment Booking Calendar — Simply Schedule Appointments…

LOW 39

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00598 Published 2024-04-09 No fix listed CWE-89

TI-2026-60450 CVE-2026-89294 · GHSA-82vp-79qw-w7jm

Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter

LOW 37

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00955 Published 2026-09-30 No fix listed CWE-98

TI-2026-28469 CVE-2026-39495 · GHSA-w79w-69fh-fq49

WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simpl…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00263 Published 2026-04-08 No fix listed CWE-89

TI-2023-27756 CVE-2023-50851 · GHSA-9vx6-546g-266v

WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Bo…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.0053 Published 2023-12-28 Fixed in 1.6.6.1 CWE-89

TI-2026-41633 CVE-2026-57812 · GHSA-crv4-3fgg-f4cf

WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability

LOW 35

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appoint…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-07-13 No fix listed CWE-862

TI-2026-04192 CVE-2026-4807 · GHSA-x96p-55v7-jmrq

Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion

LOW 35

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00492 Published 2026-05-07 No fix listed CWE-862

TI-2026-63295 CVE-2026-94074 · GHSA-w6g7-8pfm-3cwg

WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00203 Published 2026-09-30 No fix listed CWE-862

TI-2026-42486 CVE-2026-59523 · GHSA-vj2r-ffwf-623h

WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability

LOW 34

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00266 Published 2026-07-13 No fix listed CWE-862

TI-2025-42758 CVE-2025-69315 · GHSA-wgrv-6j54-h2xj

WordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerability

LOW 34

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0023 Published 2026-01-22 No fix listed CWE-862

TI-2025-10748 CVE-2025-11723 · GHSA-86xh-gm7c-mpg4

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5…

LOW 34

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.5 via the hash() function du…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00217 Published 2026-01-06 No fix listed CWE-330

TI-2026-75185 CVE-2026-104000 · GHSA-hh9h-qh43-jq4f

Cross-site scripting in croixhaug Simply Schedule Appointments

LOW 31

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and out…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00236 Published 2026-10-16 No fix listed CWE-79

TI-2026-46683 CVE-2026-65513 · GHSA-wh7j-9mm7-vj2x

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-06 No fix listed CWE-79

TI-2026-41254 CVE-2026-57317 · GHSA-x46x-px7q-p9j7

WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-06-26 No fix listed CWE-79

Open these records in search →