CVE-2026-104000 croixhaug CVE debrief

Who should care

WordPress site administrators and defenders should assess exposure and prioritize remediation due to the potential for unauthenticated attackers to inject malicious scripts. Site administrators should verify plugin versions, review debug logging configurations, and restrict access to the debug-log viewer to mitigate potential exploitation. Defenders should also review compensating controls and monitor for potential exploitation.

Why it matters

CVE-2026-104000 is a Stored Cross-Site Scripting vulnerability in the Simply Schedule Appointments plugin for WordPress. Defenders should prioritize updating or disabling the plugin, restrict access to the debug-log viewer, and verify the Support PIN configuration to mitigate potential exploitation.

• Unauthenticated attackers can inject arbitrary web scripts.
• Injected scripts execute when a user accesses an injected page.
• Scripts can be executed against administrators during support or troubleshooting workflows.
• Remediation priority is high due to the potential for exploitation.

Technical summary

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35. The vulnerability exists due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts, which will execute when a user accesses an injected page. The payload is stored due to default debug logging and accessible debug-log viewer, potentially executing scripts against administrators during support workflows.

Defensive priority

Defenders should prioritize updating or disabling the Simply Schedule Appointments plugin until a patched version is available. Site administrators should verify debug logging and restrict access to the debug-log viewer.

Recommended defensive actions

• Update the Simply Schedule Appointments plugin to a patched version if available.
• Disable the Simply Schedule Appointments plugin until a patched version is released.
• Restrict access to the debug-log viewer.
• Verify and limit access to the site-wide Support PIN.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in plugin versions up to 1.6.12.35. Debug logging is enabled by default, and the debug-log viewer is accessible via the site-wide Support PIN. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify plugin versions, review debug logging configurations, and restrict access to the debug-log viewer to mitigate potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.