Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Easy Appointments 3.12.28 Clear all filters
TI-2026-12051 CVE-2026-14226 · GHSA-vwwh-xjvm-53g2

Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing

Priority MEDIUM 53

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, al…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-07-30 Fixed in 3.12.28 CWE-200
TI-2026-12048 CVE-2026-14223 · GHSA-w8wf-cph5-qr85

Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

Priority MEDIUM 53

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal informatio…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-30 Fixed in 3.12.28 CWE-639
TI-2026-12047 CVE-2026-14222 · GHSA-hc6v-wvgv-hh32

Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

Priority MEDIUM 51

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configura…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00318 Published 2026-07-30 Fixed in 3.12.28 CWE-284
TI-2026-12019 CVE-2026-14188 · GHSA-g6jf-96rv-8293

Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

Priority MEDIUM 47

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read e…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00316 Published 2026-07-30 Fixed in 3.12.28 CWE-200