Easy Appointments is a modestly represented appointment-scheduling and booking application that serves small businesses and service providers, with its vulnerability disclosures concentrated in a single product line. The vendor's exposure profile reflects the web-application context typical of scheduling platforms, centered on input handling and authentication-related weaknesses. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Easy Appointments over time
Signals from CVEs in this vendor scope (45 CVEs).
45 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-0482CRITICAL Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | Mar 9, 2022 | 9.1 | 69 | NO | YES |
CVE-2026-2262HIGH The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appoint | Apr 18, 2026 | 7.5 | 42 | NO | YES |
CVE-2026-23622HIGH Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns ear | Jan 15, 2026 | 8.8 | 31 | NO | NO |
CVE-2023-2105HIGH Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | Apr 15, 2023 | 8.8 | 28 | NO | NO |
CVE-2026-61946MEDIUM Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions. | Jul 23, 2026 | 6.5 | 27 | NO | NO |
CVE-2025-50383HIGH alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. | Aug 25, 2025 | 8.1 | 27 | NO | NO |
CVE-2026-39513HIGH Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions. | Jun 15, 2026 | 7.5 | 26 | NO | NO |
CVE-2026-11992MEDIUM The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying tha | Jul 10, 2026 | 4.3 | 25 | NO | NO |
CVE-2024-57602CRITICAL An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. | Feb 12, 2025 | 9.8 | 25 | NO | NO |
CVE-2023-3288HIGH A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation. | Jul 9, 2024 | 8.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (45 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Easy Appointments.
Media articles that mention a CVE ID that affects a product developed by Easy Appointments — matched by CVE ID, not by vendor name.