CVE-2026-55651 | High | 7.1 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an… |
CVE-2026-52841 | Low | 3.1 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its UR… |
CVE-2026-52840 | Low | 2.7 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` ha… |
CVE-2026-52839 | Low | 3.3 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` re… |
CVE-2026-52838 | Low | 2.6 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through th… |
CVE-2026-52837 | | | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/… |
CVE-2026-42562 | High | 8.3 | 2026-05-09 | Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by subm… |
CVE-2026-23622 | High | 8.8 | 2026-01-15 | Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST req… |
CVE-2025-31828 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!… |
CVE-2024-0698 | Medium | 6.4 | 2024-03-05 | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, an… |
CVE-2023-3700 | Medium | 6.3 | 2023-07-17 | Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
|
CVE-2023-3568 | Medium | 6.3 | 2023-07-10 | Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
|
CVE-2023-2105 | High | 8.8 | 2023-04-15 | Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2104 | Medium | 5.4 | 2023-04-15 | Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2103 | Medium | 5.4 | 2023-04-15 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2102 | Medium | 4.8 | 2023-04-15 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-1367 | Low | 3.8 | 2023-03-13 | Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-1269 | Critical | 9.8 | 2023-03-08 | Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2022-1397 | High | 8.8 | 2022-05-10 | API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover. |
CVE-2022-0482 | Critical | 9.1 | 2022-03-09 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. |