Medium severity6.3NVD Advisory· Published Apr 10, 2023· Updated Jun 17, 2026

CVE-2015-10099

Description

A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Appointment Calendarcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.1.5
Package: https://wordpress.org/plugins/appointment-calendar

Patches

Vulnerability mechanics

References

github.com/wp-plugins/cp-appointment-calendar/commit/e29a9cdbcb0f37d887dd302a05b9e8bf213da01dnvdPatch
vuldb.comnvdPermissions RequiredThird Party Advisory
vuldb.comnvdPermissions RequiredThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000