Easy!Appointments is a web-based appointment-scheduling platform with a narrow product footprint that has accumulated a notable vulnerability history despite limited product diversity. The vendor's disclosures cluster around access-control and input-handling defects—including authorization bypasses tied to user-controlled keys, cross-site scripting in form handling, cross-site request forgery, and improper access control—that are characteristic of web applications managing sensitive scheduling and customer data. A meaningful share of its vulnerabilities reach serious severity, reflecting the authentication and session-management demands of a scheduling system that often integrates with payment and customer-contact workflows. Defenders deploying this platform should prioritize access-control and input-validation patches and treat internet-facing instances as a focus area for testing and remediation; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Easyappointments over time
Signals from CVEs in this vendor scope (45 CVEs).
45 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-0482CRITICAL Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | Mar 9, 2022 | 9.1 | 69 | NO | YES |
CVE-2026-2262HIGH The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appoint | Apr 18, 2026 | 7.5 | 42 | NO | YES |
CVE-2026-23622HIGH Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns ear | Jan 15, 2026 | 8.8 | 31 | NO | NO |
CVE-2023-2105HIGH Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | Apr 15, 2023 | 8.8 | 28 | NO | NO |
CVE-2026-61946MEDIUM Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions. | Jul 23, 2026 | 6.5 | 27 | NO | NO |
CVE-2025-50383HIGH alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. | Aug 25, 2025 | 8.1 | 27 | NO | NO |
CVE-2026-39513HIGH Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions. | Jun 15, 2026 | 7.5 | 26 | NO | NO |
CVE-2026-11992MEDIUM The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying tha | Jul 10, 2026 | 4.3 | 25 | NO | NO |
CVE-2024-57602CRITICAL An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. | Feb 12, 2025 | 9.8 | 25 | NO | NO |
CVE-2023-3288HIGH A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation. | Jul 9, 2024 | 8.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (45 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Easyappointments.
Media articles that mention a CVE ID that affects a product developed by Easyappointments — matched by CVE ID, not by vendor name.