Easyappointments vulnerabilities
40 vulnerabilities
Known vulnerabilities in Easyappointments products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Easy\!Appointments34 vulnerabilities
- Easy Appointments6 vulnerabilities
CVE-2018-13060easyappointmentseasy\!appointments
EPSS score0.92%
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.CVE-2018-13063easyappointmentseasy\!appointmentsEPSS score1.28%
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.CVE-2025-31828alextselegidiseasyappointments+2EPSS score0.25%
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.CVE-2025-29448easyappointmentseasy\!appointmentsEPSS score0.58%
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.CVE-2025-50383easyappointmentseasy\!appointmentsEPSS score0.36%
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.CVE-2022-1397alextselegidisalextselegidis/easyappointments+1EPSS score1.17%
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.CVE-2022-0482alextselegidisalextselegidis/easyappointments+1EPSS score43.75%
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.CVE-2024-2844easy-appointmentseasy_appointments+2EPSS score0.43%
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders.CVE-2024-2842easy-appointmentseasy_appointments+2EPSS score0.32%
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-0698alextselegidiseasyappointments+2EPSS score0.40%
The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-57601easyappointmentseasy\!appointmentsEPSS score0.52%
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parameter.CVE-2024-57602easyappointmentseasy\!appointmentsEPSS score0.83%
An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.CVE-2019-14936easyappointmentseasy\!appointments+1EPSS score1.52%
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).CVE-2026-2262easyappointmentseasy appointments+1EPSS score2.39%
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.CVE-2026-11992easyappointmentseasy appointments+1EPSS score0.46%
The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to cancel all upcoming appointments site-wide by marking every future appointment stored by the plugin as abandoned. The nonce required to authenticate the cancellation request is printed on the Appointments admin page, which is itself gated only by the edit_posts capability that Authors possess, making the nonce readily accessible to low-privileged users.CVE-2026-9232easyappointmentseasy appointments+1EPSS score0.47%
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.CVE-2026-8789easyappointmentseasy appointments+1EPSS score0.40%
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.CVE-2026-23622alextselegidiseasyappointments+1EPSS score0.23%
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.CVE-2023-2103alextselegidisalextselegidis/easyappointments+1EPSS score0.47%
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2104alextselegidisalextselegidis/easyappointments+1EPSS score0.45%
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.