CVE-2026-14225

Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.

Affected

Easy Appointments

CVSS v3.1 WPSCAN

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-08-06

Updated

2026-08-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6e95e74b-89b2-4a4f-b8a8-91d7b76cdcd2/

References

• CVE Record
• NVD entry