Stored Cross-Site Scripting in Simply Schedule Appointments WordPress Plugin

The Simply Schedule Appointments plugin for WordPress (versions 1.6.12.35 and earlier) contains a critical stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping on the 'status' parameter. Unauthenticated attackers can inject malicious JavaScript into the application, which is then stored within the plugin's debug logs. Because debug logging is enabled by default and the logs are viewable by anyone possessing the site-wide Support PIN, the injected script executes within the context of an administrator's browser session. This vulnerability poses a significant risk to the integrity of the WordPress administrative interface, as an attacker could potentially capture sensitive session data or perform unauthorized administrative actions during troubleshooting workflows.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of a victim, typically an administrator. This can lead to full compromise of the administrative interface, unauthorized site configuration changes, or session hijacking, impacting the security of any WordPress site utilizing the affected version of the Simply Schedule Appointments plugin.

Recommendation

• Update the Simply Schedule Appointments plugin to a version released after 1.6.12.35 to remediate the lack of input sanitization.
• Audit existing debug logs for suspicious script tags or obfuscated JavaScript payloads if the site has been exposed to the internet.
• Disable default debug logging if it is not required for active troubleshooting to reduce the storage of potential malicious payloads.
• Rotate the WordPress AUTH_SALT to invalidate existing Support PINs if there is reason to believe the site was accessed by unauthorized parties.