PT-2026-68645 · WordPress · Easyappointments
CVE-2026-14225
·
Published
2026-08-06
·
Updated
2026-08-07
CVSS v3.1
2.7
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Easy Appointments WordPress plugin versions prior to 3.12.28
Description
Insufficient validation of shortcode input occurs during a block-rendering action. The system only verifies the first tag of the provided string against an allowlist but renders the entire string. This allows users with contributor-level access to execute arbitrary registered shortcodes.
Recommendations
Update Easy Appointments WordPress plugin to version 3.12.28 or later.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Easyappointments