Vulnerabilities

TI-2026-19023 CVE-2026-23622 · GHSA-54v4-4685-vwrj

CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover

HIGH 74

Easy!Appointments is a self hosted appointment scheduler.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00231 Published 2026-01-15 No fix listed CWE-352

TI-2025-32119 CVE-2025-50383 · GHSA-2f28-69j7-85hf

alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection…

HIGH 74

alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00365 Published 2025-08-25 Fixed in 1.5.2-beta.1 CWE-89

TI-2025-21080 CVE-2025-29448 · GHSA-hcjv-982c-5f29

Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create…

HIGH 66

Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0059 Published 2025-05-07 No fix listed CWE-284

TI-2025-22965 CVE-2025-31828 · GHSA-x2cq-24wc-g3f9

WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00254 Published 2025-04-01 No fix listed CWE-352

TI-2023-15591 CVE-2023-32295 · GHSA-557j-83gh-rpqh

WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerability

LOW 29

Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00508 Published 2024-04-11 No fix listed CWE-862

TI-2024-00643 CVE-2024-0698 · GHSA-p824-rm68-c4g7

Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 29

The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00404 Published 2024-03-05 No fix listed CWE-79

TI-2018-09371 CVE-2018-13063 · GHSA-c2c7-gq2h-35w8

Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.

LOW 35

Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01278 Published 2020-03-16 No fix listed CWE-862

TI-2018-09370 CVE-2018-13060 · GHSA-366j-ph5m-8wm7

Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.

LOW 31

Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00917 Published 2020-03-16 No fix listed CWE-287

TI-2019-11135 CVE-2019-14936 · GHSA-9vhf-xxmx-2rg6

Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).

LOW 27

Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01517 Published 2019-09-11 No fix listed

Vulnerabilities

Filters