CVE-2026-110382
7.1HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute malicious scripts in victims' browsers via stored cross-site scripting, potentially hijacking administrative sessions when a user visits an infected page. Exploitation requires an unauthenticated attacker to inject input and an authenticated user to view the affected interface.
Root cause
The plugin fails to sanitize and neutralize user-supplied input before storing and rendering it on the web page.
Affected systems
Simply Schedule Appointments plugin through 1.6.12.35
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade Simply Schedule Appointments to a version higher than 1.6.12.35. If an update cannot be deployed immediately, deactivate the plugin until patched.
$ wp plugin update simply-schedule-appointmentsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.