8.5High

CVE-2026-39495WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability

NSquared Simply Schedule Appointments Published: 2026-04-08 11:30 (7 months ago)

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.

Weakness (CWE): CWE-89

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
NSquared	Simply Schedule Appointments	≤ 1.6.9.27

References and patches

https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-… vdb-entry

CVSS score

8.5High

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

All scores (4)

cna	CVSS 3.1	8.5High
CISA-ADP	CVSS 3.1	8.5High
audit@patchstack.com	CVSS 3.1	8.5High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.5High

EPSS (chance of exploitation in 30 days)

0.26%

higher than 18% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-04-07
Published2026-04-08 11:30
Reached IP-DB2026-10-24 23:50
Last updated2026-07-25 00:10

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

Unscored

CVE-2026-124817 1 hour ago

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Unscored

CVE-2026-76792 1 hour ago

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

User Verification by PickPlugins

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, …

Unscored

CVE-2026-124652 1 hour ago

Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR

Mine CloudVod

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item an…

Unscored

CVE-2026-124653 1 hour ago

Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Mine CloudVod

The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site'…

Unscored

CVE-2026-124665 1 hour ago

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Order Tracking

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the …

Unscored

CVE-2026-124814 1 hour ago

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Ultimate Addons for Elementor Forms

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote …