Cross-Site Scripting
10 records28.6%First: 2022. Latest: 2026.
Plugin security history
Simply Schedule Appointments Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 35 vulnerability records associated with Simply Schedule Appointments, published between 2022 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
35Total records
0Critical
13High
22Medium
0Low
0Informational
35Patched records
0Currently marked unpatched
2022-08-08First disclosure
2026-07-09Latest disclosure
35 of 35CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2022 | 2 | |
| 2023 | 1 | |
| 2024 | 8 | |
| 2025 | 4 | |
| 2026 | 20 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| High | 13 | 37.1% |
| Medium | 22 | 62.9% |
Vulnerability-Type Breakdown
SQL Injection
9 records25.7%First: 2023. Latest: 2026.
Missing Authorization
9 records25.7%First: 2025. Latest: 2026.
Information Disclosure
3 records8.6%First: 2022. Latest: 2026.
Other
3 records8.6%First: 2024. Latest: 2026.
CSRF
1 record2.9%First: 2024. Latest: 2024.
Patch Status
- Patched
- 35
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
1.6.12.01.6.12.61.6.12.41.6.11.01.6.11.91.6.11.71.6.111.6.11.21.6.10.21.6.10.01.6.9.291.6.11.11.6.9.171.6.9.131.6.9.61.6.8.321.6.8.71.6.8.51.6.7.551.6.7.431.6.7.181.6.7.91.6.6.241.6.6.11.5.7.7
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-1.6.11.11 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.11 - Missing Authorization | July 9, 2026 | 1.6.12.0 | Medium |
*-1.6.12.4 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.4 - Missing Authorization | July 9, 2026 | 1.6.12.6 | Medium |
*-1.6.12.3 | Simply Schedule Appointments <= 1.6.12.3 - Unauthenticated Stored Cross-Site Scripting | July 6, 2026 | 1.6.12.4 | High |
*-1.6.12.2 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 - Unauthenticated Stored Cross-Site Scripting | June 26, 2026 | 1.6.12.4 | High |
*-1.6.10.6 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.10.6 - Unauthenticated Stored Cross-Site Scripting | May 28, 2026 | 1.6.11.0 | High |
*-1.6.11.8 | Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint | May 27, 2026 | 1.6.11.9 | Medium |
*-1.6.11.8 | Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter | May 27, 2026 | 1.6.11.9 | High |
*-1.6.11.5 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service | May 26, 2026 | 1.6.11.7 | Medium |
*-1.6.10.6 | Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion | May 6, 2026 | 1.6.11 | Medium |
[*, 1.6.11.2) | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.11.2 - Unauthenticated Sensitive Information Exposure | April 27, 2026 | 1.6.11.2 | Medium |
*-1.6.9.27 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection | April 8, 2026 | 1.6.9.29 | High |
*-1.6.9.27 | Simply Schedule Appointments <= 1.6.9.27 - Authenticated (Contributor+) SQL Injection | March 26, 2026 | 1.6.9.29 | Medium |
*-1.6.10.0 | Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter | March 18, 2026 | 1.6.10.2 | High |
*-1.6.9.29 | Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint | March 12, 2026 | 1.6.10.0 | High |
*-1.6.9.29 | Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure | March 12, 2026 | 1.6.10.0 | Medium |
*-1.6.9.27 | Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter | March 10, 2026 | 1.6.9.29 | High |
*-1.6.11.0 | Simply Schedule Appointments <= 1.6.11.0 - Missing Authorization | February 26, 2026 | 1.6.11.1 | Medium |
*-1.6.9.15 | Simply Schedule Appointments <= 1.6.9.15 - Missing Authorization | January 20, 2026 | 1.6.9.17 | Medium |
*-1.6.9.9 | Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters | January 14, 2026 | 1.6.9.13 | High |
*-1.6.9.5 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure | January 5, 2026 | 1.6.9.6 | Medium |
*-1.6.9.16 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure | December 18, 2025 | 1.6.9.17 | Medium |
*-1.6.8.30 | Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes | June 13, 2025 | 1.6.8.32 | Medium |
*-1.6.8.5 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution | March 12, 2025 | 1.6.8.7 | High |
*-1.6.8.3 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting | March 6, 2025 | 1.6.8.5 | Medium |
*-1.6.7.53 | Appointment Booking Calendar <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings | October 15, 2024 | 1.6.7.55 | Medium |
Selected source records
Latest Records
MediumCVE-2026-57812
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.4 - Missing Authorization
Published: July 9, 2026
- Affected versions
- *-1.6.12.4
- Patched versions
- 1.6.12.6
MediumCVE-2026-59523
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.11 - Missing Authorization
Published: July 9, 2026
- Affected versions
- *-1.6.11.11
- Patched versions
- 1.6.12.0
HighCVE-2026-13400
Simply Schedule Appointments <= 1.6.12.3 - Unauthenticated Stored Cross-Site Scripting
Published: July 6, 2026
- Affected versions
- *-1.6.12.3
- Patched versions
- 1.6.12.4
HighCVE-2026-57317
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 - Unauthenticated Stored Cross-Site Scripting
Published: June 26, 2026
- Affected versions
- *-1.6.12.2
- Patched versions
- 1.6.12.4
HighCVE-2026-39447
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.10.6 - Unauthenticated Stored Cross-Site Scripting
Published: May 28, 2026
- Affected versions
- *-1.6.10.6
- Patched versions
- 1.6.11.0
MediumCVE-2026-6937
Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint
Published: May 27, 2026
- Affected versions
- *-1.6.11.8
- Patched versions
- 1.6.11.9
HighCVE-2026-7797
Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Published: May 27, 2026
- Affected versions
- *-1.6.11.8
- Patched versions
- 1.6.11.9
MediumCVE-2026-7493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service
Published: May 26, 2026
- Affected versions
- *-1.6.11.5
- Patched versions
- 1.6.11.7
Highest-Severity Records
HighCVE-2024-2342
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode
Published: March 20, 2024
- Affected versions
- *-1.6.7.7
- Patched versions
- 1.6.7.9
HighCVE-2024-2341
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection
Published: March 20, 2024
- Affected versions
- *-1.6.7.7
- Patched versions
- 1.6.7.9
HighCVE-2025-12166
Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters
Published: January 14, 2026
- Affected versions
- *-1.6.9.9
- Patched versions
- 1.6.9.13
HighCVE-2026-3045
Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
Published: March 12, 2026
- Affected versions
- *-1.6.9.29
- Patched versions
- 1.6.10.0
HighCVE-2026-3658
Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter
Published: March 18, 2026
- Affected versions
- *-1.6.10.0
- Patched versions
- 1.6.10.2
HighCVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Published: March 10, 2026
- Affected versions
- *-1.6.9.27
- Patched versions
- 1.6.9.29
HighCVE-2026-39493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection
Published: April 8, 2026
- Affected versions
- *-1.6.9.27
- Patched versions
- 1.6.9.29
HighCVE-2026-7797
Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Published: May 27, 2026
- Affected versions
- *-1.6.11.8
- Patched versions
- 1.6.11.9
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.