CVE-2026-13400 Simply Schedule CVE debrief

Who should care

Users of Simply Schedule Appointments plugin for WordPress should be aware of this vulnerability and take steps to protect themselves. This includes updating to version 1.6.12.4 or later and implementing additional security measures to detect and prevent exploitation. Administrators of WordPress installations using the Simply Schedule Appointments plugin should prioritize this update and review their security configurations to ensure they are protected against potential attacks.

Technical summary

The vulnerability is caused by a sanitization-ordering defect in the Simply Schedule Appointments plugin. The rendered notification content is decoded back into live HTML after it has already passed through the wp_kses_post() filter, allowing a double-encoded payload to survive intake and be reintroduced as an executable element at render time. This defect enables attackers to inject malicious scripts into the plugin's notifications, potentially leading to unauthorized actions or data breaches. The vulnerability affects all versions of the plugin up to and including 1.6.12.2 and is fixed in version 1.6.12.4 or later.

Defensive priority

High

Recommended defensive actions

• Update Simply Schedule Appointments plugin to version 1.6.12.4 or later
• Implement additional security measures to detect and prevent exploitation
• Monitor for suspicious activity on affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited. Official CVE and NVD records provide some information. Further investigation and verification are recommended. The Simply Schedule Appointments plugin for WordPress has a known vulnerability in versions up to and including 1.6.12.2. Users should verify their installations and consider updating to version 1.6.12.4 or later. Additional security measures, such as monitoring for suspicious activity, should be implemented to detect and prevent exploitation.

Official resources