Easy!Appointments

Easy!Appointments has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 4 issues recorded for Easy!Appointments has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Easy!Appointments is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Easy!Appointments vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2023-32295

Easy!Appointments <= 1.4.0 - Authenticated(Subscriber+) Arbitrary File Deletion via 'disconnect'

Read the full analysis

Vulnerability Records

4 records
Easy!Appointments banner
Latestv1.5.2

Easy!Appointments

alextselegidis

Author

alextselegidis

4.4(5)
88/100
Last Updated
2026-09-07 (5d ago)
Active Installs
500+
Downloads
43,775
Requires WP
5.0+
Requires PHP
5.6+
Tested up to
WP 7.1
Created
2016-04-17 (11y ago)

Let customers book appointments on your website, 24/7, without paying a monthly subscription or a fee on every booking. Easy!Appointments gives your visitors a proper booking experience: they pick a service, pick a staff member, see the real free slots from your calendar, choose a time, and confirm. You and your customer both get an email. The appointment lands in your calendar. That’s it. It runs on your own hosting, so there is no subscription, no per-booking cut, no cap on how many appointments you take, and no third-party company sitting on your customers’ names, phone numbers, and appointment history. See it working before you install anything Try the real booking form and the real admin calendar, right now, no signup: https://demo.easyappointments.org That takes about 60 seconds and will tell you more than this page can. Please read this bit: it explains the two pieces This is the part most people ask about, so here it is up front and in plain language. Easy!Appointments is made of two things: Easy!Appointments, the booking engine. It holds your calendar, services, staff, working hours, holidays, customers and emails. It is free and open source, and you install it on your own hosting (most shared hosts handle it fine, as it needs PHP and MySQL, the same as WordPress). This plugin, the bridge. It puts the booking form from that engine straight onto a page of your WordPress site, on your domain, inside your theme, so customers never get bounced off to a different-looking website to book. So yes, you need Easy!Appointments installed somewhere before this plugin does anything. We would rather tell you that in the first 30 seconds than have you find out after installing. Why it is built that way: keeping the booking engine separate is exactly what lets it be free, unlimited and fully yours. Nobody can raise your price, change the terms, or lock your customer list behind an upgrade, because nobody else is holding it. Get the engine here: https://easyappointments.org What it costs Nothing. There is no paid tier, no trial that runs out, and no feature held back for an upgrade. No monthly or yearly subscription No commission or fee on any booking No per-staff or per-user pricing No cap on appointments, services, staff or customers What it does cost is the hosting you are already paying for, plus the time to install the booking engine once. Because you own that installation, nobody can raise your price, change the terms, or put your customer list behind an upgrade later. Setting it up Once your Easy!Appointments engine is running, the WordPress side takes about three minutes: Install and activate this plugin. Open Easy!Appts in your WordPress menu, paste your Easy!Appointments web address, click Connect. Open the page where you want bookings and add the Easy!Appointments block. Publish. Your booking form is live on that page. Bookings appear in your Easy!Appointments calendar as they come in. Three ways to place the booking form Block editor (Gutenberg). Click +, search “Easy!Appointments”, drop it in. Size and options are in the settings panel on the right. No code. Elementor. Search “Easy!Appointments” in the widget panel and drag it onto the canvas. Everything is configured with normal Elementor controls. Anything else. Classic editor, WPBakery, Divi, a theme widget area: the [easyappointments] shortcode works wherever shortcodes work. You can also point a specific page at a specific service or staff member, so “Book a haircut with Maria” is its own page. Who this is for It was built first for appointment-based local businesses: salons, barbershops, spas, nail studios, tattoo studios, physiotherapists, dentists and clinics. Anywhere customers book a named person for a fixed-length slot. It also gets used well beyond that: consultants and coaches, tutors, driving schools, workshops and repair shops, vets, law and accountancy practices, and university and government departments. Who is behind it Easy!Appointments has been developed in the open since 2014. 4,300+ stars and 1,500+ forks on GitHub Used by organisations including NEOM, Doctors Without Borders and Dolce & Gabbana Active public support community and issue tracker GPL licensed, so you can read every line, fork it, and never be locked out What you get Real-time availability from your own calendar Multiple services with individual durations and prices Multiple staff members with their own hours and days off Confirmation and reminder emails to both sides Google Calendar sync Works on phones, where most bookings come from Booking form available in 33 languages, plugin screens in nine Your branding, your domain, your data Honest notes You do need to install the Easy!Appointments engine on hosting you control. If you want a booking form with no separate installation at all, this is not that plugin, and we would rather you knew now. It is a self-hosted, open-source project. That means no bill, and it also means you set up your own email sending and updates. The documentation walks through both. Support comes from the community and the issue tracker rather than a paid helpdesk. Response times vary. Get in touch Easy!Appointments is built and maintained by Alex Tselegidis. If you are weighing it up, stuck on an installation, wondering whether it fits an unusual booking workflow, or you need custom work or a commercial arrangement around it, write to me directly: info@alextselegidis.com and https://alextselegidis.com Feature ideas and bug reports are just as welcome. Tell me what you were trying to do and where it got in the way. Documentation: https://easyappointments.org/documentation More about the WordPress integration: https://easyappointments.org/wordpress Minimum requirements: WordPress 5.0 and PHP 5.6.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C