Unauthenticated Stored XSS in Simply Schedule Appointments Plugin

Executive Summary

CVE-2026-13400 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Simply Schedule Appointments WordPress plugin affecting versions up to 1.6.12.2. The issue occurs due to a sanitization-ordering defect where HTML content is decoded back into executable HTML after passing through a security filter. This allows a double-encoded malicious payload to bypass initial sanitization and execute when rendered in the admin dashboard.

Useful 0 Not Useful 0

Detection Guidance

Check if the Simply Schedule Appointments plugin version is below 1.6.12.4. Inspect database entries for booking notifications containing suspicious HTML or JavaScript payloads. Review server logs for unauthorized booking submissions with encoded payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by submitting a booking with a malicious payload in customer information. The payload is stored in the database and later executed when an administrator previews the booking notification. This can lead to session hijacking, unauthorized actions, or malware delivery in the administrator's browser without requiring authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. If exploited, it may result in data breaches, unauthorized modifications, or disclosure of protected health or personal information, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Simply Schedule Appointments plugin to version 1.6.12.4 or later immediately. Remove any suspicious bookings from the database. Implement additional input sanitization for customer information fields.

Useful 0 Not Useful 0