{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1119", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-07T17:04:57.660Z", "datePublished": "2025-03-13T06:56:56.733Z", "dateUpdated": "2026-04-08T16:38:22.055Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:22.055Z"}, "affected": [{"vendor": "croixhaug", "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.8.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}], "title": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3250719/simply-schedule-appointments/trunk/booking-app-new/page-appointment-edit.php"}, {"url": "https://blog.lucianohanna.com.br/2025/03/28/execucao-arbitraria-de-shortcode-e-stored-xss-em-simply-schedule-appointments-cve-2025-1119/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Luciano Hanna"}], "timeline": [{"time": "2025-02-09T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-13T20:40:36.734057Z", "id": "CVE-2025-1119", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-13T20:40:46.893Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1119", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-13T20:40:36.734057Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-13T20:40:42.241Z"}}], "cna": {"title": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution", "credits": [{"lang": "en", "type": "finder", "value": "Luciano Hanna"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "croixhaug", "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.8.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-09T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3250719/simply-schedule-appointments/trunk/booking-app-new/page-appointment-edit.php"}, {"url": "https://blog.lucianohanna.com.br/2025/03/28/execucao-arbitraria-de-shortcode-e-stored-xss-em-simply-schedule-appointments-cve-2025-1119/"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:22.055Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1119", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:38:22.055Z", "dateReserved": "2025-02-07T17:04:57.660Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-13T06:56:56.733Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}, {"lang": "es", "value": "El complemento Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin para WordPress es vulnerable a la ejecuci\u00f3n de shortcodes arbitrarios en todas las versiones hasta la 1.6.8.5 incluida. Esto se debe a que el software permite a los usuarios ejecutar una acci\u00f3n que no valida correctamente un valor antes de ejecutar do_shortcode. Esto permite que atacantes no autenticados ejecuten shortcodes arbitrarios."}], "id": "CVE-2025-1119", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-13T07:15:36.517", "references": [{"source": "security@wordfence.com", "url": "https://blog.lucianohanna.com.br/2025/03/28/execucao-arbitraria-de-shortcode-e-stored-xss-em-simply-schedule-appointments-cve-2025-1119/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3250719/simply-schedule-appointments/trunk/booking-app-new/page-appointment-edit.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:49:30.669318+00:00", "value": {"mitigation_remediation": ["Update the Simply Schedule Appointments Booking Plugin to a version newer than 1.6.8.5.", "If an update is not immediately available, disable or uninstall the plugin to eliminate the attack surface.", "Implement web\u2011application\u2011firewall rules or access\u2011control restrictions that block requests containing arbitrary shortcode parameters to mitigate exploitation while a patch is applied."], "summary": {"action": "Patch immediately", "impact": "Arbitrary code execution via unwarranted shortcode processing"}, "threat_synthesis": {"affected_systems": "The issue affects the Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin for WordPress versions 1.6.8.5 and earlier. No other products are listed, so only installations of this plugin within those version ranges are vulnerable.", "description_and_impact": "The vulnerable WordPress plugin allows unfiltered input to be passed to the do_shortcode function, enabling an attacker to include any shortcode string that WordPress will then execute. This code injection flaw (CWE\u201194) permits the injection of malicious code or content, potentially leading to cross\u2011site scripting or other site compromises. Because the plugin does not validate or restrict the shortcode parameters, the flaw can be exploited by any user with network access.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high severity, and although the EPSS score is less than 1%, it is still nonzero, showing that an attacker could craft an exploit. The vulnerability is not in CISA\u2019s KEV catalog. Attackers would need to send a crafted HTTP request to the plugin endpoint that processes shortcodes. Because the attack requires no authentication, it can be performed by any internet\u2011connected user who can reach the site, enabling arbitrary shortcode execution that may lead to site compromise or malicious payload execution."}}}}, "created": "2026-04-22T18:00:05.477899+00:00", "updated": "2026-04-22T18:00:05.477917+00:00", "vendors": []}