The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

easyappointments

Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

fossbilling

Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

easyappointments

API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.

easyappointments

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

easyappointments