https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-7877.htmlhttps://patchthecve.com/cve/CVE-2024-7877.htmlWed, 17 Jun 2026 08:21:05 +0000MEDIUM 4.8: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is dihttps://patchthecve.com/cve/CVE-2024-7876.htmlhttps://patchthecve.com/cve/CVE-2024-7876.htmlWed, 17 Jun 2026 08:21:05 +0000MEDIUM 4.8: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html ihttps://patchthecve.com/cve/CVE-2024-7129.htmlhttps://patchthecve.com/cve/CVE-2024-7129.htmlWed, 17 Jun 2026 08:19:24 +0000HIGH 7.2: The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as adminshttps://patchthecve.com/cve/CVE-2024-4288.htmlhttps://patchthecve.com/cve/CVE-2024-4288.htmlWed, 17 Jun 2026 08:01:36 +0000MEDIUM 6.4: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and including, 1.6.7.14 due to insufficient input sanitization and output escaping. This makes it possible for https://patchthecve.com/cve/CVE-2024-2342.htmlhttps://patchthecve.com/cve/CVE-2024-2342.htmlWed, 17 Jun 2026 07:24:21 +0000HIGH 8.8: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatiohttps://patchthecve.com/cve/CVE-2024-2341.htmlhttps://patchthecve.com/cve/CVE-2024-2341.htmlWed, 17 Jun 2026 07:24:21 +0000HIGH 8.8: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on thhttps://patchthecve.com/cve/CVE-2024-1760.htmlhttps://patchthecve.com/cve/CVE-2024-1760.htmlWed, 17 Jun 2026 07:04:57 +0000MEDIUM 4.3: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssa_factory_reset() function. This makes it poss