CVE-2026-39447

14th percentile - higher than 14% of all known CVEs

Versions of Simply Schedule Appointments up to 1.6.10.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the application's security and the organization's data.

It is recommended to update to the latest version of Simply Schedule Appointments to mitigate this security vulnerability.