{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-104000/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simplyscheduleappointments:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-104000"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Simply Schedule Appointments (\u003c= 1.6.12.35)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","wordpress","cve-2026-104000"],"_cs_type":"advisory","_cs_vendors":["Simply Schedule Appointments"],"content_html":"\u003cp\u003eThe Simply Schedule Appointments plugin for WordPress (versions 1.6.12.35 and earlier) contains a critical stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping on the 'status' parameter. Unauthenticated attackers can inject malicious JavaScript into the application, which is then stored within the plugin's debug logs. Because debug logging is enabled by default and the logs are viewable by anyone possessing the site-wide Support PIN, the injected script executes within the context of an administrator's browser session. This vulnerability poses a significant risk to the integrity of the WordPress administrative interface, as an attacker could potentially capture sensitive session data or perform unauthorized administrative actions during troubleshooting workflows.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of a victim, typically an administrator. This can lead to full compromise of the administrative interface, unauthorized site configuration changes, or session hijacking, impacting the security of any WordPress site utilizing the affected version of the Simply Schedule Appointments plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Simply Schedule Appointments plugin to a version released after 1.6.12.35 to remediate the lack of input sanitization.\u003c/li\u003e\n\u003cli\u003eAudit existing debug logs for suspicious script tags or obfuscated JavaScript payloads if the site has been exposed to the internet.\u003c/li\u003e\n\u003cli\u003eDisable default debug logging if it is not required for active troubleshooting to reduce the storage of potential malicious payloads.\u003c/li\u003e\n\u003cli\u003eRotate the WordPress AUTH_SALT to invalidate existing Support PINs if there is reason to believe the site was accessed by unauthorized parties.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:26:25Z","date_published":"2026-10-16T06:26:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-104000-xss/","summary":"The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.","title":"Stored Cross-Site Scripting in Simply Schedule Appointments WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-104000-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-104000","version":"https://jsonfeed.org/version/1.1"}