CVE-2026-8789 | High | 8.1 | 2026-07-24 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification… |
CVE-2026-11992 | Medium | 4.3 | 2026-07-10 | The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not p… |
CVE-2026-2262 | High | 7.5 | 2026-04-18 | The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v… |
CVE-2026-23622 | High | 8.8 | 2026-01-15 | Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST req… |
CVE-2025-50383 | High | 8.1 | 2025-08-25 | alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. |
CVE-2025-29448 | High | 7.5 | 2025-05-07 | Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of ser… |
CVE-2025-31828 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!… |
CVE-2024-57602 | Critical | 9.8 | 2025-02-12 | An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. |
CVE-2024-57601 | Medium | 6.1 | 2025-02-12 | Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parame… |
CVE-2023-3290 | Medium | 5.0 | 2024-07-09 | A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized dat… |
CVE-2023-3289 | High | 7.7 | 2024-07-09 | A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthori… |
CVE-2023-3288 | High | 8.5 | 2024-07-09 | A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation. |
CVE-2023-3287 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation. |
CVE-2023-3286 | High | 7.7 | 2024-07-09 | A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. This results in unauthorized… |
CVE-2023-38055 | Critical | 9.6 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admi… |
CVE-2023-38054 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This… |
CVE-2023-38053 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including ad… |
CVE-2023-38052 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results… |
CVE-2023-38051 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)… |
CVE-2023-38050 | Critical | 9.1 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)… |
CVE-2023-38049 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (incl… |
CVE-2023-38048 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This res… |
CVE-2023-38047 | High | 8.5 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including a… |
CVE-2023-32295 | Medium | 6.3 | 2024-04-11 | Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3. |
CVE-2024-2844 | Medium | 4.3 | 2024-03-29 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointmen… |
CVE-2024-2842 | Medium | 6.4 | 2024-03-29 | The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, an… |
CVE-2024-0698 | Medium | 6.4 | 2024-03-05 | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, an… |
CVE-2023-3700 | Medium | 6.3 | 2023-07-17 | Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
|
CVE-2023-2105 | High | 8.8 | 2023-04-15 | Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2104 | Medium | 5.4 | 2023-04-15 | Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2103 | Medium | 5.4 | 2023-04-15 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2102 | Medium | 4.8 | 2023-04-15 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-1367 | Low | 3.8 | 2023-03-13 | Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-1269 | Critical | 9.8 | 2023-03-08 | Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2022-1397 | High | 8.8 | 2022-05-10 | API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover. |
CVE-2022-0482 | Critical | 9.1 | 2022-03-09 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. |
CVE-2018-13063 | High | 7.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. |
CVE-2018-13060 | Medium | 6.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. |
CVE-2019-14936 | Medium | 5.3 | 2019-09-11 | Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). |