CVE-2026-14225 — Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the suppl…
Published: 2026-08-06 · CVSS: 2.7 · CVSS 3.1
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7