Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Easy Appointments — Vulnerabilities & Security Advisories 23

All 23 CVE vulnerabilities found in Easy Appointments, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses for the Easy Appointments appointment scheduling plugin developed by the Easy Appointments vendor, tagged as a WordPress application vulnerability. The collection encompasses a wide spectrum of security flaws including cross-site scripting, local file inclusion, and authentication bypass issues reported between the plugin's initial release and the current year. Visitors can utilize this resource to track the vendor's official security advisories, understand the specific characteristics of common weakness classes affecting scheduling software, or examine the complete historical record of vulnerabilities associated with this product. By centralizing these disparate reports, the page provides a clear view of the plugin's security posture over time without requiring users to search multiple external databases. The data presented focuses strictly on confirmed technical details and remediation guidance, allowing security professionals and administrators to make informed decisions regarding their deployment. No specific CVE identifiers are listed here to maintain a broad overview of the vulnerability landscape. This compilation serves as a reference for auditing existing installations and planning future security updates for environments relying on Easy Appointments.

Vendor: Unknown

CVE ID Title CVSS Severity Published
CVE-2026-9232 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action CWE-862 6.5 Medium 2026-09-19
CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR - - 2026-09-18
CVE-2026-87965 Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token - - 2026-09-18
CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-09-08
CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing - - 2026-08-19
CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass 2.7 Low 2026-08-06
CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization - - 2026-07-30
CVE-2026-14226 Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing - - 2026-07-30
CVE-2026-14223 Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR - - 2026-07-30
CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure - - 2026-07-30
CVE-2026-14221 Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization - - 2026-07-30
CVE-2026-14224 Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR - - 2026-07-29
CVE-2026-8789 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion CWE-863 8.1 High 2026-07-24
CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability CWE-639 6.5 Medium 2026-07-23
CVE-2026-11992 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation CWE-862 4.3 Medium 2026-07-10
CVE-2026-39513 WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability CWE-862 7.5 High 2026-06-15
CVE-2026-2262 Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API CWE-200 7.5 High 2026-04-17
CVE-2025-49398 WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability CWE-80 6.5 Medium 2025-11-06
CVE-2023-30748 WordPress Easy Appointments plugin <= 3.10.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability CWE-79 4.3 Medium 2024-12-09
CVE-2024-2844 Easy Appointments <= 3.11.18 - Insufficient Authorization CWE-862 4.3 Medium 2024-03-29
CVE-2024-2842 Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-03-29
CVE-2022-36424 WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF) CWE-352 4.3 Medium 2023-07-17
CVE-2022-4668 Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode 5.4 - 2023-01-23

All 23 known CVE vulnerabilities affecting Easy Appointments with full Chinese analysis, references, and POCs where available.