VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 27 known issues Latest disclosed May 06, 2026

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Vulnerabilities

Review known vulnerability records for the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (`simply-schedule-appointments`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-4807, CVE-2026-42384 and CVE-2026-39493, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
27
High or Critical
9
Patch Coverage
100%
Last Updated
May 06, 2026
Related Security Guides

Use these guides while reviewing Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
27
1. Match the Package
Confirm the installed WordPress plugin slug is simply-schedule-appointments before acting on any CVE from this cluster.
2. Sort by Severity
Start with 9 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
27 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2024-2341 High
SQL Injection remediation for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Affected range: Versions up to 1.6.7.7. Fixed version: 1.6.7.9.

CVE-2024-2342 High
SQL Injection remediation for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Affected range: Versions up to 1.6.7.7. Fixed version: 1.6.7.9.

CVE-2026-39493 High
SQL Injection remediation for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Affected range: Versions up to 1.6.9.27. Fixed version: 1.6.9.29.

CVE-2026-3658 High
SQL Injection remediation for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Affected range: Versions up to 1.6.10.0. Fixed version: 1.6.10.2.

Priority CVE Quick Links

Fast paths into Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
27
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2024-2341
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7....
 SQL Injection Versions up to 1.6.7.7 1.6.7.9 CVSS 8.8
CVE-2024-2342
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7....
 SQL Injection Versions up to 1.6.7.7 1.6.7.9 CVSS 8.8
CVE-2026-39493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9....
 SQL Injection Versions up to 1.6.9.27 1.6.9.29 CVSS 7.5
CVE-2026-3658
Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields...
 SQL Injection Versions up to 1.6.10.0 1.6.10.2 CVSS 7.5
CVE-2026-3045
Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated...
 Sensitive Information Exposure Versions up to 1.6.9.29 1.6.10.0 CVSS 7.5
CVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append...
 SQL Injection Versions up to 1.6.9.27 1.6.9.29 CVSS 7.5
CVE-2025-12166
Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order`...
 SQL Injection Versions up to 1.6.9.9 1.6.9.13 CVSS 7.5
CVE-2025-1119
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8....
 Vulnerability Versions up to 1.6.8.5 1.6.8.7 CVSS 7.3
CVE-2024-2341 High 1.6.7.9
CVE-2024-2341 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection

CVE-2024-2342 High 1.6.7.9
CVE-2024-2342 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode

CVE-2026-39493 High 1.6.9.29
CVE-2026-39493 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection

CVE-2026-3658 High 1.6.10.2
CVE-2026-3658 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection

Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter

CVE-2026-3045 High 1.6.10.0
CVE-2026-3045 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Sensitive Information Exposure

Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint

CVE-2026-1708 High 1.6.9.29
CVE-2026-1708 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection

Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter

CVE-2025-12166 High 1.6.9.13
CVE-2025-12166 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection

Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters

CVE-2025-1119 High 1.6.8.7
CVE-2025-1119 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Vulnerability

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
27 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 9 high severity findings.
Recent CVEs
CVE-2026-4807, CVE-2026-42384 and CVE-2026-39493
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-4807
CVE-2026-4807: Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed authorization logic in the nonce_permissions_check() method combined with the public exposure of a site-wide reusable non...

Published
May 06, 2026
Patched Release
1.6.11
Affected Versions
Versions up to 1.6.10.6
Next Step
Update to 1.6.11 or newer if supported.
Review CVE-2026-4807 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-42384
CVE-2026-42384: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.11.2 - Unauthenticated Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.6.11.2 (exclusive). This makes it possible for unauthenticated attackers to extract sensitive user or config...

Published
Apr 27, 2026
Patched Release
1.6.11.2
Affected Versions
Versions before 1.6.11.2
Next Step
Update to 1.6.11.2 or newer if supported.
Review CVE-2026-42384 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-39493
CVE-2026-39493: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.6.9.27 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis...

Published
Apr 08, 2026
Patched Release
1.6.9.29
Affected Versions
Versions up to 1.6.9.27
Next Step
Update to 1.6.9.29 or newer if supported.
Review CVE-2026-39493 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-39495
CVE-2026-39495: Simply Schedule Appointments <= 1.6.9.27 - Authenticated (Contributor+) SQL Injection

The Simply Schedule Appointments plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.6.9.27 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for aut...

Published
Mar 26, 2026
Patched Release
1.6.9.29
Affected Versions
Versions up to 1.6.9.27
Next Step
Update to 1.6.9.29 or newer if supported.
Review CVE-2026-39495 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-3658
CVE-2026-3658: Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of suf...

Published
Mar 18, 2026
Patched Release
1.6.10.2
Affected Versions
Versions up to 1.6.10.0
Next Step
Update to 1.6.10.2 or newer if supported.
Review CVE-2026-3658 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-3045
CVE-2026-3045: Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to u...

Published
Mar 12, 2026
Patched Release
1.6.10.0
Affected Versions
Versions up to 1.6.9.29
Next Step
Update to 1.6.10.0 or newer if supported.
Review CVE-2026-3045 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-1704
CVE-2026-1704: Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users wi...

Published
Mar 12, 2026
Patched Release
1.6.10.0
Affected Versions
Versions up to 1.6.9.29
Next Step
Update to 1.6.10.0 or newer if supported.
Review CVE-2026-1704 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-1708
CVE-2026-1708: Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class failing to prevent t...

Published
Mar 10, 2026
Patched Release
1.6.9.29
Affected Versions
Versions up to 1.6.9.27
Next Step
Update to 1.6.9.29 or newer if supported.
Review CVE-2026-1708 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-39694
CVE-2026-39694: Simply Schedule Appointments <= 1.6.11.0 - Missing Authorization

The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.6.11.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
Feb 26, 2026
Patched Release
1.6.11.1
Affected Versions
Versions up to 1.6.11.0
Next Step
Update to 1.6.11.1 or newer if supported.
Review CVE-2026-39694 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-69315
CVE-2025-69315: Simply Schedule Appointments <= 1.6.9.15 - Missing Authorization

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.6.9.15. This makes it possible for unauthenticated atta...

Published
Jan 20, 2026
Patched Release
1.6.9.17
Affected Versions
Versions up to 1.6.9.15
Next Step
Update to 1.6.9.17 or newer if supported.
Review CVE-2025-69315 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-12166
CVE-2025-12166: Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and including, 1.6.9.9 due to insufficient escaping on the user suppli...

Published
Jan 14, 2026
Patched Release
1.6.9.13
Affected Versions
Versions up to 1.6.9.9
Next Step
Update to 1.6.9.13 or newer if supported.
Review CVE-2025-12166 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11723
CVE-2025-11723: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.5 via the hash() function due to use of a hardcoded fall-back salt. This makes it possib...

Published
Jan 05, 2026
Patched Release
1.6.9.6
Affected Versions
Versions up to 1.6.9.5
Next Step
Update to 1.6.9.6 or newer if supported.
Review CVE-2025-11723 fixed version details Open CVE Reference