Skip to content
OpenAdvisories

Product · Easy Appointments

Easy Appointments

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-9232

    Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

    The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above…

    Easy Appointments Easy Appointments Web / CMS
  • Medium 6.5
    CVE-2026-61946 Public exploit

    WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

    Easy Appointments Easy Appointments
  • Medium 4.3
    CVE-2026-11992

    Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation

    The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authent…

    Easy Appointments Easy Appointments Web / CMS
  • Medium 6.5
    CVE-2025-49398

    WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Code Injection.This issue affects Easy Appointments: from n/a through <= 3.12.14.

    Easy Appointments Easy Appointments
  • Medium 6.4
    CVE-2024-2842

    Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied att…

    Easy Appointments Easy Appointments Web / CMS
  • Medium 4.3
    CVE-2024-2844

    Easy Appointments <= 3.11.18 - Insufficient Authorization

    The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticat…

    Easy Appointments Easy Appointments Web / CMS