CVE-2026-39447: WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the Simply Schedule Appointments WordPress plugin by NSquared, affecting all versions up to and including 1.6.10.6. The flaw is reachable over the network with no authentication required, but a victim must interact with a crafted link or page for the attack to succeed. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, page content manipulation, and in some configurations lateral movement within the WordPress admin panel. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress installation over the network to deliver the malicious payload.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated external party.

• Victim interactionRequired

  A victim (typically a logged-in WordPress user or administrator) must interact with a crafted link or page for the injected script to execute in their browser.

• Attack complexityDetail

  Exploit complexity is low, meaning no special conditions, race windows, or environmental factors need to align for the attack to succeed.

Blast Radius

• An attacker can execute arbitrary JavaScript in the victim's browser session, reading session cookies and authentication tokens associated with the WordPress site.
• Injected script can modify page content visible to the victim, including form fields, enabling credential harvesting.
• With scope change (S:C in the CVSS vector), the impact extends beyond the vulnerable component and can affect the broader browser origin, including other scripts or frames running in the same context.
• Availability is rated as low-impact, meaning the injected payload can cause limited disruption to the page or user session, such as breaking UI elements or forcing logouts.