Is CVE-2026-104000 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104000 being exploited in the wild.

How severe is CVE-2026-104000?

High severity, with a CVSS score of 7.2, published 16 October 2026.

Which products and versions are affected?

WordPress.org Simply Schedule Appointments up to and including 1.6.12.35.

Is there a fix for CVE-2026-104000?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104000 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104000?

Check whether you run WordPress.org Simply Schedule Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104000: Simply Schedule Appointments plugin stored cross-site scripting

CVE-2026-104000 · Severity: high · CVSS 7.2 · Published 2026-10-16

The Simply Schedule Appointments plugin for WordPress contains a stored cross-site scripting vulnerability in the status parameter that allows unauthenticated attackers to inject malicious scripts. Because debug logging is enabled by default and accessible to anyone with the site's Support PIN, attackers can inject code that executes in administrators' browsers during troubleshooting workflows, enabling session hijacking, credential theft, or malware installation.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-104000 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104000 being exploited in the wild.
How severe is CVE-2026-104000?: High severity, with a CVSS score of 7.2, published 16 October 2026.
Which products and versions are affected?: WordPress.org Simply Schedule Appointments up to and including 1.6.12.35.
Is there a fix for CVE-2026-104000?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104000 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104000?: Check whether you run WordPress.org Simply Schedule Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists due to insufficient input sanitization and output escaping of the 'status' parameter. Unauthenticated attackers can inject arbitrary JavaScript that is stored unconditionally in debug logs; the injected script executes against administrator sessions when the debug-log viewer is accessed using the site-wide Support PIN (HMAC-MD5 of AUTH_SALT), which is displayed in wp-admin and thus known to potential attackers.

Affected products

WordPress.org Simply Schedule Appointments up to and including 1.6.12.35

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.