CVE-2026-65513

Unauthenticated SQL Injection vulnerability in Simply Schedule Appointments versions up to 1.6.12.10.

There is an unauthenticated SQL injection vulnerability in Simply Schedule Appointments versions up to 1.6.9.27.

The Simply Schedule Appointments WordPress plugin before version 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users. This allows users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.

The Simply Schedule Appointments WordPress plugin before version 1.6.12.6 does not restrict a bulk appointment operation to the requester's own records. Unauthenticated users can retrieve personal data of all appointments and, on premium editions, permanently delete them.

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.

The Simply Schedule Appointments WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.6.11.11.

The Simply Schedule Appointments WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.6.12.4.

The vulnerability allows an unauthenticated attacker to execute XSS scripts in the Simply Schedule Appointments plugin versions up to and including 1.6.12.2.

The Simply Schedule Appointments application versions below 1.6.11.2 have a vulnerability that allows unauthorized access to sensitive data.

Versions of Simply Schedule Appointments up to 1.6.10.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.