CVE-2026-14225

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.

CVSS v3.1

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 14th percentile

Published

2026-08-06

Updated

2026-08-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6e95e74b-89b2-4a4f-b8a8-91d7b76cdcd2/

References

• CVE Record
• NVD entry

Related

• CVE-2026-14224
• CVE-2026-14226
• CVE-2026-14223
• CVE-2026-14229
• CVE-2026-14222
• CVE-2026-1423