CyberRota Analysis
AI-GeneratedThe Simply Schedule Appointments plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a flaw in its sanitization process, affecting all versions up to 1.6.12.2. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users viewing the affected notifications, potentially leading to data theft or site compromise. WordPress site administrators using this plugin should prioritize updating to version 1.6.12.4 or later to mitigate this risk.
Original NVD Description
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.