Read the docs
TI-2022-02190 Aliases CVE-2022-2374GHSA-v5j3-cc7g-2rf3

Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Why it matters now

EPSS 0.00692 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Simply Schedule Appointments – WordPress Booking Plugin (Unknown): 1.5.7.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimply Schedule Appointments – WordPress Booking Plugin1.5.7.7 to before 1.5.7.71.5.7.7Patch availableCNA
  • Simply Schedule Appointments – WordPress Booking Plugin VendorUnknown Affected 1.5.7.7 to before 1.5.7.7 Fixed in 1.5.7.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nsqua:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*before 1.5.7.7VulnerableNsqua
  • cpe:2.3:a:nsqua:simply_schedule_appointments:*:*:*:*:*:wordpress:*:* Versions before 1.5.7.7 Vulnerable ·Nsqua

Remediation

  • Fix · CNA Simply Schedule Appointments – WordPress Booking Plugin (Unknown) Fixed in 1.5.7.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Simply Schedule Appointments – WordPress Booking Plugin 1.5.7.7

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-02189 Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address DisclosurePriority LOW 28
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2374
  2. 2026-10-03 Alias added: GHSA-v5j3-cc7g-2rf3

References

Exploit 1

  • TI-2024-06599 Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE CVSS 3.1HIGH 7.2
  • TI-2024-07301 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2024-07300 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2023-27756 WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
  • TI-2022-02189 Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences