Easyappointments
Source repositories
CVEs (38)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-13063 | Hig | 0.49 | 7.5 | 0.01 | Mar 16, 2020 | Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. | ||
| CVE-2025-50383 | Hig | 0.46 | 8.1 | 0.00 | Aug 25, 2025 | alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. | ||
| CVE-2025-29448 | Hig | 0.42 | 7.5 | 0.01 | May 7, 2025 | Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability. | ||
| CVE-2018-13060 | Med | 0.42 | 6.5 | 0.01 | Mar 16, 2020 | Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. | ||
| CVE-2023-32295 | Med | 0.41 | 6.3 | 0.01 | Apr 11, 2024 | Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3. | ||
| CVE-2024-57601 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2025 | Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parameter. | ||
| CVE-2024-0698 | Med | 0.35 | 6.4 | 0.00 | Mar 5, 2024 | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it… | ||
| CVE-2019-14936 | Med | 0.35 | 5.3 | 0.02 | Sep 11, 2019 | Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). | ||
| CVE-2023-3700 | Med | 0.34 | 6.3 | 0.00 | Jul 17, 2023 | Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | ||
| CVE-2023-3290 | Med | 0.33 | 5.0 | 0.00 | Jul 9, 2024 | A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation. | ||
| CVE-2025-31828 | Med | 0.28 | 4.3 | 0.00 | Apr 1, 2025 | Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2. | ||
| CVE-2023-2104 | Med | 0.28 | 5.4 | 0.00 | Apr 15, 2023 | Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | ||
| CVE-2023-2103 | Med | 0.28 | 5.4 | 0.00 | Apr 15, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | ||
| CVE-2023-2102 | Med | 0.24 | 4.8 | 0.01 | Apr 15, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | ||
| CVE-2023-1367 | Low | 0.18 | 3.8 | 0.00 | Mar 13, 2023 | Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | ||
| CVE-2026-52839 | Low | 0.14 | 3.3 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints… | ||
| CVE-2026-52838 | Low | 0.10 | 2.6 | 0.00 | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later… | ||
| CVE-2025-50455 | Cri | 0.00 | 9.1 | 0.01 | Jul 27, 2026 | SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to… |
- risk 0.49cvss 7.5epss 0.01
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
- risk 0.46cvss 8.1epss 0.00
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.
- risk 0.42cvss 7.5epss 0.01
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.
- risk 0.42cvss 6.5epss 0.01
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
- risk 0.41cvss 6.3epss 0.01
Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parameter.
- risk 0.35cvss 6.4epss 0.00
The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
- risk 0.35cvss 5.3epss 0.02
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).
- risk 0.34cvss 6.3epss 0.00
Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- risk 0.33cvss 5.0epss 0.00
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
- risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.
- risk 0.28cvss 5.4epss 0.00
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- risk 0.18cvss 3.8epss 0.00
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- risk 0.14cvss 3.3epss 0.00
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints…
- risk 0.10cvss 2.6epss 0.00
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later…
- risk 0.00cvss 9.1epss 0.01
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to…
Page 2 of 2