Now officially on WordPress.org

CVE Database / CVE-2026-65508

CVE · Critical

CVE-2026-65508 — Simply Schedule Appointments [simply-schedule-appointments] < 1.6.12.11

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-65508 Simply Schedule Appointments [simply-schedule-appointments] < 1.6.12.11 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Critical 9.3 < 1.6.12.11 1.6.12.11 2026-07-28 —

CVE-2026-65508

The Simply Schedule Appointments plugin for WordPress contains a security flaw in versions up through 1.6.12.10, where user-submitted input is not properly sanitized, allowing malicious actors to inject unauthorized SQL code into database queries. This vulnerability enables attackers to access and extract sensitive data from the database without requiring authentication.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings