Easy Appointments

Easy Appointments has 20 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; 19 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 13 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (30%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

19 of the records (95%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

17 independent researchers contributed these findings, most of them (3) reported by István Márton. Easy Appointments is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891029.05.2015Today16.10.20176.1Easy Appointments < 1.12.0 - Cross-Site Scripting CVSS 6.1 · 16.10.201727.12.20226.4Easy Appointments <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 27.12.202214.04.20234.4Easy Appointments <= 3.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 14.04.202305.05.20236.3Easy Appointments <= 3.11.9 - Cross-Site Request Forgery via multiple AJAX actions CVSS 6.3 · 05.05.202328.03.20246.4Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 28.03.20244.3Easy Appointments <= 3.11.18 - Insufficient Authorization CVSS 4.3 · 28.03.202409.09.20256.5Easy Appointments <= 3.12.14 - Unauthenticated Arbitrary Shortcode Execution CVSS 6.5 · 09.09.202513.04.20265.3Easy Appointments <= 3.12.21 - Missing Authorization CVSS 5.3 · 13.04.202617.04.20267.5Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API CVSS 7.5 · 17.04.202609.07.20264.3Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation CVSS 4.3 · 09.07.202616.07.20265.3Easy Appointments <= 3.12.27 - Unauthenticated Insecure Direct Object Reference CVSS 5.3 · 16.07.202623.07.20268.1Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion CVSS 8.1 · 23.07.202629.07.20264.3Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 29.07.202630.07.20264.3Easy Appointments < 3.12.28 - Authenticated (Contributor+) Insecure Direct Object Reference CVSS 4.3 · 30.07.20264.3Easy Appointments < 4.0.1 - Missing Authorization CVSS 4.3 · 30.07.20264.3Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 30.07.20264.3Easy Appointments < 3.12.28 - Missing Authorization CVSS 4.3 · 30.07.20264.3Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Information Exposure CVSS 4.3 · 30.07.202621.08.20264.3Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure CVSS 4.3 · 21.08.202607.09.20267.2Easy Appointments <= 4.0.2.1 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 07.09.2026

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage95%
Open

1

Fixed

19

Get automatic notifications for all Easy Appointments vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-81798

Easy Appointments <= 4.0.2.1 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

20 records
2026-09-07 12:32CVE-2026-81798
7.2
High
0xzenkoNo
2026-08-21 00:00CVE-2026-19406
4.3
Medium
Shikhali JamalzadeYes
2026-07-30 00:00CVE-2026-14188
4.3
Medium
Mustafa AhmedYes
2026-07-30 00:00CVE-2026-14221
4.3
Medium
Youssef massoudiYes
2026-07-30 00:00CVE-2026-14223
4.3
Medium
Mark MooreYes
2026-07-30 00:00CVE-2026-14222
4.3
Medium
WEI HSIANG WANGYes
2026-07-30 00:00CVE-2026-14226
4.3
Medium
Phyo Ko KoYes
2026-07-29 00:00CVE-2026-14224
4.3
Medium
Duy TranYes
2026-07-23 16:53CVE-2026-8789
8.1
High
Vamshi Krishna UpadrastaYes
2026-07-16 00:00CVE-2026-61946
5.3
Medium
Daniel WadeYes
Showing 1–10 of 20 reports
Easy Appointments banner
Latestv4.0.2.1

Easy Appointments

Easy Appointments

Author

Easy Appointments

4.3(131)
86/100
Last Updated
2026-09-02 (11d ago)
Active Installs
10,000+
Downloads
1,867,118
Requires WP
5.0+
Requires PHP
5.3+
Tested up to
WP 7.1
Created
2015-05-29 (12y ago)

Easy Appointments lets you add a fully-featured booking system to any WordPress site — in minutes. Whether you run a salon, clinic, law firm, gym, or tutoring business, your customers book online while you stay in control of your calendar. Over 10,000+ active sites trust Easy Appointments to handle their bookings every day. Perfect for 💇 Beauty & wellness — salons, spas, massage therapists, barbers 🏥 Health & medical — doctors, dentists, physiotherapists, therapists ⚖️ Professional services — lawyers, accountants, consultants 🏋️ Fitness & coaching — personal trainers, yoga instructors, tutors 🔧 Trades & home services — mechanics, cleaners, plumbers 🏨 Hospitality & leisure — escape rooms, photography studios, event venues Live Demo Responsive Appointment form Responsive Appointment form – two column layout Full calendar NEW Standard Appointment form Doc Documentation Everything you need to run your bookings 📅 Flexible scheduling, your way Set your availability exactly how you need it — multiple locations, multiple staff, multiple services, all with independent time slots. Supports even the most complex schedules without writing a line of code. 📧 Automatic email notifications Customers get instant booking confirmations. Staff get notified. You can customise every email template, trigger reminders, and let customers confirm or cancel via a link — no chasing required. 📱 Booking forms that look great everywhere Responsive single or two-column layouts that work on mobile, tablet, and desktop. Embed anywhere with a simple shortcode. 🛠️ Build the form you need Add custom fields, require information, set up Google reCAPTCHA to block spam, and drag-and-drop your fields into any order. 🌍 Works in any language Translated into 10+ languages. Date picker localised for 77 locales. Full translation support for your custom labels. 📊 Reports & exports View your booking calendar at a glance and export appointments to CSV for use in Excel, Google Sheets, or your CRM. More Features Multiple Locations Multiple Services Multiple Workers Create dedicated calendar for one location / service / worker Create time slots by connecting location – service – worker and date/time Multiple time slots Fine granular option for creating even most complex time table Bulk connections builder Extremely flexible time table Email notifications : Send email notification to customer on creation and update of appointment Send email notification to predefined list of admin users Send email notification to employee Custom content and subject Custom admin email Confirm booking via link provided inside email Cancel booking via link provided inside email HTML content via WYSIWYG editor Custom emails for different status of appointments : pending, reservation, canceled, confirmed Include any information from booking inside email content even from custom fields Single Column Responsive Bootstrap Layout for Appointment form Two Column Responsive Bootstrap layout Custom form fields : Create your own custom form fields in a few clicks textarea select input Make fields required Drag and drop order Google reCAPTCHA v2 Google reCAPTCHA v3 NEW NEW use current logged in user data sa default value for custom field. Internationalization – support for translations (you can create your own translation >> tutorial <<) German translation (thanks to Matthias) Romanian translation (thanks to Vlad) Polish translation (thanks to Maciej Bauza) Finnish translation thanks to Maija Portuguese translation thanks to Antonio Portuguese Brazil translation thanks to seniweb Labels Hide price Add custom currency Set currency before/after price Custom style Localization of datepicker for 77 different languages (day of week, months) Reports Time table overview Export to CSV (for Calc, Excel…) 🚀 Need more power? Upgrade to Easy Appointments Pro The Pro extension unlocks everything serious businesses need: Google Calendar sync — 2-way sync so your team always sees the full picture SMS & WhatsApp notifications — reduce no-shows with automated reminders via Twilio Online payments — collect deposits or full payment via Stripe, PayPal, or WooCommerce at booking AI Booking Assistant — let customers book via a conversational chat widget iCalendar feeds — sync with Apple Calendar, Outlook, and any .ics-compatible app Room & resource booking — book meeting rooms, equipment, or any shared resource 👉 See Pro plans and pricing → For more info follow the link for Extension plugin HomePage easy-appointments.com External services FullCalendar This plugin uses the FullCalendar JavaScript library to display interactive calendars and events within the plugin interface. FullCalendar itself does not collect or transmit personal data. All calendar data is generated and managed locally within the plugin or retrieved from configured services such as Google Calendar. This service is provided by FullCalendar LLC Terms of use and Policy : https://fullcalendar.io/license

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C