CVE-2026-14225

Deferred Deferred - Pending Action

Arbitrary Shortcode Execution in Easy Appointments WordPress Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-14225

Affected Vendors & Products

Vendor	Product	Version / Range
easy_appointments	easy_appointments	3.12.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The Easy Appointments WordPress plugin up to version 3.12.26 has a flaw in how it handles shortcode input during block rendering. It only checks the first tag of a user-supplied string against an allowlist but then processes the entire string, allowing contributors to execute any registered shortcode.

Detection Guidance

To detect this vulnerability, check for unauthorized shortcode execution in WordPress. Inspect WordPress logs for suspicious shortcode usage, particularly from contributor-level users. Review plugin files for the Easy Appointments plugin version 3.12.26 or earlier. Use commands like grep to search for shortcode patterns in logs or database entries.

Impact Analysis

An attacker with contributor-level access could exploit this to run arbitrary shortcodes, potentially leading to unauthorized actions like data theft, content manipulation, or other malicious activities depending on the shortcodes available.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update the Easy Appointments WordPress plugin to version 3.12.26 or later to address the shortcode validation issue.

Hi! I’m here to help you understand CVE-2026-14225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70