CVE-2026-104000 in Simply Schedule Appointments Plugin
Summary
by MITRE • 10/16/2026
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within the Simply Schedule Appointments plugin for WordPress represents a critical security flaw classified as Stored Cross-Site Scripting, commonly referred to as persistent XSS. This issue affects all versions of the plugin up through 1.6.12.35 and stems from insufficient input sanitization and output escaping mechanisms when handling the status parameter. Unlike reflected cross-site scripting attacks where malicious scripts are executed immediately within a victim's browser via a crafted link, stored vulnerabilities involve injecting code that is permanently saved on the target server. In this specific case, the injection point is tied to the debug logging functionality which is enabled by default in many WordPress installations for troubleshooting purposes. The lack of proper validation allows an unauthenticated attacker to inject arbitrary web scripts into these log entries without needing any prior authentication credentials or privileges within the application.
The operational impact of this vulnerability is severe due to the specific context in which the malicious payload resides and how it is accessed. Because debug logging captures user inputs, including those from external sources like appointment status updates, an attacker can embed JavaScript code directly into these logs. The critical factor amplifying the risk is that the debug-log viewer interface is accessible to anyone possessing the site-wide Support PIN. This pin is derived from an HMAC-MD5 hash of the AUTH_SALT constant found in the WordPress configuration file wp-config.php and is displayed within the wp-admin dashboard area for support purposes. Consequently, any individual with access to this administrative view can trigger the execution of the stored script against their own session or potentially other users if they have broader access rights. This effectively bypasses traditional authentication barriers by leveraging legitimate administrative workflows such as troubleshooting or customer support interactions.
From a technical perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The root cause lies in the failure to properly sanitize user-supplied data before storage and to escape it appropriately during output rendering. By allowing raw script tags or event handlers to persist within the database entries for debug logs, the application violates fundamental web security principles regarding trust boundaries. Furthermore, this attack vector maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution under command and scripting interpreter techniques. The attacker utilizes standard browser-based scripting capabilities rather than complex exploit chains or system-level vulnerabilities, making the exploitation straightforward and reliable across modern web browsers that support standard DOM manipulation events.
The implications extend beyond simple defacement or session hijacking for individual users. Since the payload is stored server-side, it persists until manually removed from the logs, creating a long-term risk surface. If an administrator views the debug log while logged into their WordPress dashboard, the injected script executes within that privileged context. This can lead to complete account compromise through cookie theft, allowing attackers to impersonate the site owner and gain full control over the website content, plugins, and potentially underlying server configurations if further exploitation chains are developed. Additionally, because the vulnerability requires no authentication for injection but relies on a specific administrative view for execution, it creates an asymmetric attack model where low-privilege actors can inflict high-severity damage by exploiting trusted interfaces.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade the Simply Schedule Appointments plugin to version 1.6.12.36 or later, where developers have implemented proper input validation and output escaping for the status parameter within debug logging routines. For organizations unable to patch immediately, disabling debug logging in production environments significantly reduces exposure by preventing the storage of untrusted data in accessible log files. Administrators should also ensure that support PINs are rotated regularly and restricted to only those personnel who strictly require access to sensitive diagnostic information. Implementing a Content Security Policy (CSP) header can further mitigate impact by restricting script execution sources, although this is not a substitute for fixing the underlying input validation flaw. Regular security audits of third-party plugins and adherence to secure coding standards such as OWASP Top Ten guidelines are essential to prevent similar vulnerabilities in future deployments.