PT-2025-11158 · WordPress · Appointment Booking Calendar

Luciano Hanna · Published 2025-03-13 · Updated 2025-03-18 · CVE-2025-1119

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress versions up to 1.6.8.5

Description: The issue arises from the software's failure to properly validate a value before executing do shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes. This is due to the software permitting users to execute an action without correct validation.

Recommendations: For versions up to 1.6.8.5, update to a version later than 1.6.8.5 to resolve the issue. As a temporary workaround, consider restricting access to the do shortcode function until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-1119

Affected Products

Appointment Booking Calendar

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-1119 · Security Note
• https://t.me/cvedetector/20188 · Telegram Post
• https://t.me/latest_high_impact_cve/1957 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3250719/simply-schedule-appointments/trunk/booking-app-new/page-appointment-edit.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=cve · Note
• https://t.me/cvetracker/19030 · Telegram Post
• https://blog.lucianohanna.com.br/2025/03/28/execucao-arbitraria-de-shortcode-e-stored-xss-em-simply-schedule-appointments-cve-2025-1119 · Note
• https://t.me/cvenotify/114571 · Telegram Post
• https://twitter.com/cracbot/status/1901951793090990512 · Twitter Post
• https://twitter.com/vulns_space/status/1900093185344348314 · Twitter Post
• https://twitter.com/cybercronai/status/1900389018262556803 · Twitter Post
• https://twitter.com/CVEnew/status/1900082986965459453 · Twitter Post