Stored XSS Vulnerability in Simply Schedule Appointments Plugin

CVE-2026-110382 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Simply Schedule Appointments WordPress plugin, versions 1.6.12.35 and earlier. The flaw arises from improper neutralization of user-supplied input when generating web pages. An attacker can leverage this vulnerability to inject arbitrary JavaScript into the plugin's administrative dashboard interface. When an administrator views the compromised page, the malicious script executes within their browser session. This could allow an attacker to perform unauthorized actions on behalf of the administrator, such as modifying plugin settings, creating new administrative accounts, or capturing session tokens, depending on the site's configuration and the privileges of the victim.

Impact

Successful exploitation leads to unauthorized administrative actions and potential full compromise of the WordPress site. Organizations utilizing Simply Schedule Appointments are at risk of site defacement, unauthorized data access, or the deployment of additional malicious components. As of the disclosure, there is no evidence of widespread exploitation in the wild, though the vulnerability's impact on administrative accounts makes it a high-priority concern for site integrity.

Recommendation

• Upgrade the Simply Schedule Appointments plugin to a version released after 1.6.12.35 to remediate the vulnerability.
• Implement a Content Security Policy (CSP) to mitigate the execution of unauthorized scripts in the event of an XSS vulnerability.
• Review administrative audit logs for suspicious activity or unauthorized account creation that might follow a successful script execution.