Unknown Simply Schedule Appointments vulnerabilities

4 CVEs affecting Unknown Simply Schedule Appointments, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16541, published 2026-08-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16540, published 2026-08-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve…
CVE-2026-16541, published 2026-08-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users…
CVE-2026-15254, published 2026-08-03. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open…
CVE-2026-13400, published 2026-07-27. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered…