# Simply Schedule Appointments

> Unlimited appointments, booking calendars, and notifications. Powerful appointment booking plugin and booking system. Start scheduling for free today!

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:36 UTC.

## Facts (WordPress.org)

- Slug: `simply-schedule-appointments`
- Author: NSquared
- Version: 1.6.13.4
- Active installs: 50,000+
- Last update: 2026-11-10 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.1, PHP 7.4
- Tags: appointment booking, appointments, booking, booking system, scheduling
- Page: https://wordpress.org/plugins/simply-schedule-appointments/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-11-11 MEDIUM: Missing Authorization (up to 1.6.13.0). CVE-2026-125437, https://www.wordfence.com/threat-intel/vulnerabilities/id/6bc50960-4638-44b9-baa8-977b220c5d01?source=api-prod
- 2026-10-18 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.6.12.35). CVE-2026-110382, https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b96c66-92b5-42cf-8b65-7874ff5fdccb?source=api-prod
- 2026-10-16 HIGH: Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} (up to 1.6.12.35). CVE-2026-104000, https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8bd422-112c-43bc-a041-3c6eea27b790?source=api-prod
- 2026-10-15 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (up to 1.6.12.35). CVE-2026-110381, https://www.wordfence.com/threat-intel/vulnerabilities/id/165ab739-070c-42e8-83d2-003eb1120fe0?source=api-prod
- 2026-10-10 MEDIUM: Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token (up to 1.6.11.11). CVE-2026-6723, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f16178-1aa3-4af2-a125-74467bc57e70?source=api-prod
- 2026-10-01 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter (up to 1.6.12.31). CVE-2026-91109, https://www.wordfence.com/threat-intel/vulnerabilities/id/d1cd3de2-16ca-4f95-ad6f-47cfbe00c959?source=api-prod
- 2026-10-01 HIGH: Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the... (up to 1.6.12.32). CVE-2026-92245, https://www.wordfence.com/threat-intel/vulnerabilities/id/1984f80e-06ec-4d7f-9a75-e05e7b73b57c?source=api-prod
- 2026-09-30 MEDIUM: Missing Authorization (up to 1.6.12.29). CVE-2026-94074, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb28ef31-657d-4d95-b651-98dbdcaf3dd7?source=api-prod
- 2026-09-30 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 1.6.12.31). CVE-2026-94673, https://www.wordfence.com/threat-intel/vulnerabilities/id/549f5da2-fc42-4eab-89f5-9ba6bc2cb57b?source=api-prod
- 2026-09-30 HIGH: Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter (up to 1.6.12.27). CVE-2026-89294, https://www.wordfence.com/threat-intel/vulnerabilities/id/aab8f2ae-993b-4893-81cc-1b8a1a4ef84b?source=api-prod
- 2026-09-02 MEDIUM: Cross-Site Request Forgery (up to 1.6.12.23). CVE-2026-84764, https://www.wordfence.com/threat-intel/vulnerabilities/id/30502e0f-cae6-4d48-837c-77127c39731b?source=api-prod
- 2026-08-16 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure (up to 1.6.12.10). CVE-2026-13358, https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbe5094-d255-46b1-9e8e-9c48cd74e8a2?source=api-prod
- 2026-08-15 MEDIUM: Authenticated (Team Member+) Information Exposure (up to 1.6.12.16). CVE-2026-16541, https://www.wordfence.com/threat-intel/vulnerabilities/id/8e76ee22-b05c-424a-a2a9-8d83811668e0?source=api-prod
- 2026-08-06 HIGH: Unauthenticated SQL Injection (up to 1.6.12.10). CVE-2026-65508, https://www.wordfence.com/threat-intel/vulnerabilities/id/42acc6e4-ceee-4551-bca4-4f8d0a958eef?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.6.12.10). CVE-2026-65513, https://www.wordfence.com/threat-intel/vulnerabilities/id/879df622-ca6a-45ea-b8f9-e3882d4bfff7?source=api-prod
- 2026-08-03 MEDIUM: Missing Authorization to Authenticated (Contributor+) Sensitive Data Disclosure (up to 1.6.12.10). CVE-2026-15254, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8341ff1-9515-4999-9fd7-c8fe7a29bf6f?source=api-prod
- 2026-08-02 MEDIUM: Unauthenticated Insecure Direct Object Reference (before 1.6.12.6). CVE-2026-16540, https://www.wordfence.com/threat-intel/vulnerabilities/id/64292fc7-8f74-4515-988b-f803b0fd7494?source=api-prod
- 2026-07-27 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.6.12.3). CVE-2026-13400, https://www.wordfence.com/threat-intel/vulnerabilities/id/e11c9f2c-4ac6-4da2-9b4c-d393e2d3332b?source=api-prod
- 2026-07-13 MEDIUM: Missing Authorization (up to 1.6.12.4). CVE-2026-57812, https://www.wordfence.com/threat-intel/vulnerabilities/id/7249469c-a46d-40fc-bf05-ae0bef72e655?source=api-prod
- 2026-07-13 MEDIUM: Missing Authorization (up to 1.6.11.11). CVE-2026-59523, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f906e8c-0b20-4da7-86b8-3306f36c46a4?source=api-prod
- 2026-06-26 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.6.12.2). CVE-2026-57317, https://www.wordfence.com/threat-intel/vulnerabilities/id/12817b77-17d0-418c-a9a1-87d0057da90e?source=api-prod
- 2026-06-15 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.6.10.6). CVE-2026-39447, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3ad5fd-e190-48c8-864f-11cc7342080a?source=api-prod
- 2026-06-15 HIGH: Unauthenticated SQL Injection (up to 1.6.9.27). CVE-2026-39493, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c69d0ec-d533-416b-9bc1-a3d5a871469a?source=api-prod
- 2026-06-15 MEDIUM: Unauthenticated Sensitive Information Exposure (before 1.6.11.2). CVE-2026-42384, https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2e44ea-0049-4370-abd0-0b631e3d2d37?source=api-prod
- 2026-05-28 HIGH: Unauthenticated SQL Injection via 'append_where_sql' Parameter (up to 1.6.11.8). CVE-2026-7797, https://www.wordfence.com/threat-intel/vulnerabilities/id/db3bddbd-44b0-4105-9039-0d669d643481?source=api-prod
- 2026-05-28 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint (up to 1.6.11.8). CVE-2026-6937, https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0f5f9d-788a-4cf8-9747-ada076a69a1f?source=api-prod
- 2026-05-27 MEDIUM: Unauthenticated Denial of Service (up to 1.6.11.5). CVE-2026-7493, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66228e-d086-44fd-8acb-5a99482cedfb?source=api-prod
- 2026-05-07 MEDIUM: Unauthenticated Arbitrary Appointment View, Modification and Deletion (up to 1.6.10.6). CVE-2026-4807, https://www.wordfence.com/threat-intel/vulnerabilities/id/436ab843-7729-4d57-9c9e-2ede2f101ddb?source=api-prod
- 2026-03-26 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 1.6.9.27). CVE-2026-39495, https://www.wordfence.com/threat-intel/vulnerabilities/id/b7f6436f-60b7-4b9b-a071-93a5b95a9075?source=api-prod
- 2026-03-18 HIGH: Unauthenticated SQL Injection via 'fields' Parameter (up to 1.6.10.0). CVE-2026-3658, https://www.wordfence.com/threat-intel/vulnerabilities/id/67c7b9b2-e73f-47fe-aecc-14e998a607c8?source=api-prod
- 2026-03-12 HIGH: Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint (up to 1.6.9.29). CVE-2026-3045, https://www.wordfence.com/threat-intel/vulnerabilities/id/5970b8d6-0041-4c30-a6ce-fe67ebf415f5?source=api-prod
- 2026-03-12 MEDIUM: Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure (up to 1.6.9.29). CVE-2026-1704, https://www.wordfence.com/threat-intel/vulnerabilities/id/c82f3864-13af-4ff6-824a-4c799a98f3f6?source=api-prod
- 2026-03-10 HIGH: Unauthenticated SQL Injection via 'append_where_sql' Parameter (up to 1.6.9.27). CVE-2026-1708, https://www.wordfence.com/threat-intel/vulnerabilities/id/71642341-9fe0-44a9-88f3-70167dc6ca62?source=api-prod
- 2026-02-26 MEDIUM: Missing Authorization (up to 1.6.11.0). CVE-2026-39694, https://www.wordfence.com/threat-intel/vulnerabilities/id/d48899b9-b3b3-45d7-b7e1-6a8560becb0b?source=api-prod
- 2026-01-20 MEDIUM: Missing Authorization (up to 1.6.9.15). CVE-2025-69315, https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb94259-5f24-49dd-bf4b-0c1dd996d9d4?source=api-prod
- 2026-01-14 HIGH: Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters (up to 1.6.9.9). CVE-2025-12166, https://www.wordfence.com/threat-intel/vulnerabilities/id/5214a399-21a4-4573-9840-1d5043781bc0?source=api-prod
- 2026-01-05 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 1.6.9.5). CVE-2025-11723, https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f3fbd2-6152-4a89-8fe9-982120d1a640?source=api-prod
- 2025-12-18 MEDIUM: Missing Authorization to Unauthenticated Sensitive Information Exposure (up to 1.6.9.16). CVE-2025-13754, https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=api-prod
- 2025-06-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (up to 1.6.8.30). CVE-2025-4667, https://www.wordfence.com/threat-intel/vulnerabilities/id/414173b9-d23e-4e44-bf8c-77a074bb09e9?source=api-prod
- 2025-03-12 HIGH: Unauthenticated Arbitrary Shortcode Execution (up to 1.6.8.5). CVE-2025-1119, https://www.wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=api-prod
- 2025-03-06 MEDIUM: Reflected Cross-Site Scripting (up to 1.6.8.3). CVE-2024-13431, https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e3e5dd-b9f1-4d24-98cc-b6ab319434e4?source=api-prod
- 2024-10-15 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Notification Settings (up to 1.6.7.53). CVE-2024-7877, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e170f98-692b-48f1-92b0-530cbe21440b?source=api-prod
- 2024-10-15 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings (up to 1.6.7.53). CVE-2024-7876, https://www.wordfence.com/threat-intel/vulnerabilities/id/13d544ae-fbca-42d9-9d74-5e018092e097?source=api-prod
- 2024-08-23 HIGH: Authenticated (Admin+) Remote Code Execution (up to 1.6.7.42). CVE-2024-7129, https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6f3607-d44f-452a-b3ad-55f036033480?source=api-prod
- 2024-05-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.6.7.14). CVE-2024-4288, https://www.wordfence.com/threat-intel/vulnerabilities/id/84262b4a-a662-4aaf-9eae-f5cca8f6cd06?source=api-prod
- 2024-03-26 MEDIUM: Reflected Cross-Site Scripting (up to 1.6.6.20). CVE-2024-22311, https://www.wordfence.com/threat-intel/vulnerabilities/id/4291b5c8-cce3-46ae-b9ff-a34a0f5bcdce?source=api-prod
- 2024-03-20 HIGH: Authenticated (Contributor+) SQL Injection via Shortcode (up to 1.6.7.7). CVE-2024-2342, https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0dd466-a78a-4b79-b9bd-5363f69d9a4c?source=api-prod
- 2024-03-20 HIGH: Authenticated (Subscriber+) SQL Injection (up to 1.6.7.7). CVE-2024-2341, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4930b03-9142-464e-98ae-a910dfa46f2a?source=api-prod
- 2024-03-05 MEDIUM: Cross-Site Request Forgery to Plugin Data Reset (up to 1.6.6.20). CVE-2024-1760, https://www.wordfence.com/threat-intel/vulnerabilities/id/0eec9744-6dbd-42bd-b9c5-c9d792cecf4b?source=api-prod
- 2023-12-21 MEDIUM: Authenticated(Administrator+) SQL Injection (before 1.6.6.1). CVE-2023-50851, https://www.wordfence.com/threat-intel/vulnerabilities/id/775d4ba7-7198-493c-bae0-7f3f78741b90?source=api-prod
- 2022-08-08 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.5.7.5). CVE-2022-2374, https://www.wordfence.com/threat-intel/vulnerabilities/id/71f059ba-1874-4e8a-80e9-3f7826f9341d?source=api-prod
- 2022-08-08 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 1.5.7.5). CVE-2022-2373, https://www.wordfence.com/threat-intel/vulnerabilities/id/9614aaa9-d343-4fd4-8a40-7366cd961bd3?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=simply-schedule-appointments · HTML: https://todaywp.com/plugins/simply-schedule-appointments