CVE Database /
CVE-2025-12166
CVE · High
CVE-2025-12166 — Simply Schedule Appointments [simply-schedule-appointments] < 1.6.9.13
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-12166
|
Simply Schedule Appointments [simply-schedule-appointments] < 1.6.9.13 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
High
7.5
|
< 1.6.9.13
|
1.6.9.13 |
2026-01-14 |
—
|
CVE-2025-12166
The Simply Schedule Appointments Booking Plugin for WordPress contains a security flaw that allows malicious actors to inject unauthorized SQL code into database queries, enabling them to access sensitive data without authentication. This vulnerability arises from inadequate protection of user input and insufficient modification of existing SQL statements. Affected versions include all releases up to 1.6.9.9.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings