Vulnerability history

Cross Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability

Authenticated (Subscriber+) Local File Inclusion vulnerability

Broken Access Control vulnerability

Insecure Direct Object References (IDOR) vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Contributor+ Sensitive Data Disclosure via Admin Shortcode vulnerability

WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability

Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability

Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability

Unauthenticated Stored XSS vulnerability

Cross Site Scripting (XSS) vulnerability

SQL Injection vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Cross Site Scripting (XSS) vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated SQL Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Modification vulnerability

Unauthenticated Denial of Service vulnerability

Unauthenticated Arbitrary Appointment View, Modification and Deletion vulnerability

Sensitive Data Exposure vulnerability

SQL Injection vulnerability

SQL Injection vulnerability

Unauthenticated SQL Injection via 'fields' Parameter vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint vulnerability

Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure vulnerability

Unauthenticated SQL Injection via 'append_where_sql' Parameter vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters vulnerability

Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability

Reflected Cross-Site Scripting vulnerability

Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Admin+ Template Injection to RCE vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Authenticated (Contributor+) SQL Injection via Shortcode vulnerability

Authenticated (Subscriber+) SQL Injection vulnerability

Cross-Site Request Forgery to Plugin Data Reset vulnerability

SQL Injection vulnerability

Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Email Address Disclosure vulnerability