CVE-2025-67551
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Wappointment plugin (versions up to and including 2.6.9) contains a stored XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session data theft or account takeover. All users visiting infected pages are at risk.
Recommendation
Update the Wappointment plugin to a version higher than 2.6.9. Additionally, implement input validation and sanitization in forms.
Other vulnerabilities in Wappointment
See all- CVE-2026-39756Medium
The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.
- CVE-2026-9188Medium
The Wappointment plugin for WordPress up to version 2.7.6 contains an Insecure Direct Object Reference (IDOR) vulnerability. The authorization key `edit_key` is generated as a predictable, unsalted MD5 hash of a sequential client ID, a publicly observable timestamp, and a small staff ID, allowing unauthenticated attackers to compute it and cancel or reschedule other users' appointments.
- CVE-2025-68575Medium
Missing Authorization vulnerability in Wappointment team Wappointment allows exploiting incorrectly configured access control security levels. This issue affects Wappointment through <= 2.7.6.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wappointment team Wappointment wappointment allows Stored XSS.This issue affects Wappointment: from n/a through <= 2.6.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS