Easy Appointments
Source repositories
CVEs (19)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-3287 | Cri | 0.64 | 9.9 | 0.00 | Jul 9, 2024 | A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation. | ||
| CVE-2023-38049 | Cri | 0.64 | 9.9 | 0.00 | Jul 9, 2024 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation. | ||
| CVE-2023-38048 | Cri | 0.64 | 9.9 | 0.00 | Jul 9, 2024 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This results in unauthorized access and unauthorized data manipulation. | ||
| CVE-2023-38050 | Cri | 0.59 | 9.1 | 0.00 | Jul 9, 2024 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation. | ||
| CVE-2023-3288 | Hig | 0.55 | 8.5 | 0.00 | Jul 9, 2024 | A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation. | ||
| CVE-2018-13063 | Hig | 0.49 | 7.5 | 0.01 | Mar 16, 2020 | Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. | ||
| CVE-2024-2842 | Med | 0.42 | 6.4 | 0.00 | Mar 29, 2024 | The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes… | ||
| CVE-2018-13060 | Med | 0.42 | 6.5 | 0.01 | Mar 16, 2020 | Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. | ||
| CVE-2017-15812 | Med | 0.40 | 6.1 | 0.01 | Oct 23, 2017 | The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel. | ||
| CVE-2026-55651 | Hig | 0.39 | 7.1 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or… | ||
| CVE-2026-52837 | Med | 0.38 | — | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars… | ||
| CVE-2022-4668 | Med | 0.35 | 5.4 | 0.00 | Jan 23, 2023 | The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be… | ||
| CVE-2023-30748 | Med | 0.28 | 4.3 | 0.00 | Dec 9, 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7. | ||
| CVE-2024-2844 | Med | 0.28 | 4.3 | 0.00 | Mar 29, 2024 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to… | ||
| CVE-2022-36424 | Med | 0.28 | 4.3 | 0.00 | Jul 17, 2023 | Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions. | ||
| CVE-2026-52839 | Low | 0.14 | 3.3 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints… | ||
| CVE-2026-52841 | Low | 0.13 | 3.1 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row… | ||
| CVE-2026-52840 | Low | 0.11 | 2.7 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user… | ||
| CVE-2026-52838 | Low | 0.10 | 2.6 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later… |
- risk 0.64cvss 9.9epss 0.00
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
- risk 0.64cvss 9.9epss 0.00
A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- risk 0.64cvss 9.9epss 0.00
A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This results in unauthorized access and unauthorized data manipulation.
- risk 0.59cvss 9.1epss 0.00
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- risk 0.55cvss 8.5epss 0.00
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
- risk 0.49cvss 7.5epss 0.01
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
- risk 0.42cvss 6.4epss 0.00
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…
- risk 0.42cvss 6.5epss 0.01
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
- risk 0.40cvss 6.1epss 0.01
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
- risk 0.39cvss 7.1epss 0.00
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or…
- risk 0.38cvss —epss 0.00
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars…
- risk 0.35cvss 5.4epss 0.00
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be…
- risk 0.28cvss 4.3epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7.
- risk 0.28cvss 4.3epss 0.00
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to…
- risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.
- risk 0.14cvss 3.3epss 0.00
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints…
- risk 0.13cvss 3.1epss 0.00
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row…
- risk 0.11cvss 2.7epss 0.00
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user…
- risk 0.10cvss 2.6epss 0.00
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later…