Unknown Online Scheduling And Appointment Booking System vulnerabilities

4 CVEs affecting Unknown Online Scheduling And Appointment Booking System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86841, published 2026-09-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13395, published 2026-07-30. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests…
CVE-2026-91847, published 2026-09-19. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated…
CVE-2026-86841, published 2026-09-27. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature…
CVE-2026-86839, published 2026-09-27. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the…