Executive brief
Simply Schedule Appointments, a popular WordPress plugin used for managing bookings and schedules, contains a security flaw that allows unauthenticated visitors to inject malicious scripts into the system. By submitting a specially crafted booking request, an attacker can store a hidden script that executes whenever an administrator views the booking details or notification previews. This could allow an attacker to hijack administrative sessions, steal sensitive cookies, or perform unauthorized actions on the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Simply Schedule Appointments versions <= 1.6.12.2. The root cause is a sanitization-ordering defect where rendered notification content is decoded back into live HTML after passing through the wp_kses_post() filter. An unauthenticated attacker can submit a double-encoded payload (e.g., &lt;img src=x onerror=...&gt;) via the public booking REST API endpoint (/wp-json/ssa/v1/appointments). Because the payload is double-encoded, it survives the initial intake sanitization; however, the plugin's notification preview mechanism subsequently decodes the entities, reintroducing executable HTML elements into the DOM via v-html (innerHTML). This allows for arbitrary JavaScript execution in the context of an authenticated administrator. The issue is addressed in version 1.6.12.4.
Affected products
- Simply Schedule Appointments Simply Schedule Appointments up to and including 1.6.12.2
Timeline
- 2026-07-27: advisory: Vulnerability disclosed via WPScan and NVD
- 2026-07-27: disclosed