CVE-2025-12842: Timeslotplugins Time Slot – Booking And Appointment System

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails to arbitrary recipients with attacker-controlled text content in certain email fields, potentially enabling the site to be abused for phishing campaigns or spam distribution.

Affected products

• Timeslotplugins Time Slot – Booking And Appointment System: up to and including 1.4.7

Published 2025-11-19. Last modified 2026-06-17.