Timeslot Vulnerabilities

[en] The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification ema...

Affected:

up to 1.4.8

Fixed in:

1.4.8

Disclosed:

Nov 19, 2025

CVE-2025-12842 on NVD →

The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails t...

CVSS:

5.3

Affected:

up to 1.4.7

Fixed in:

1.4.8

Disclosed:

Nov 18, 2025

CVE-2025-12842 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Time Slot Booking Time Slot allows Stored XSS.This issue affects Time Slot: from n/a through 1.3.6.

Affected:

up to 1.3.7

Fixed in:

1.3.7

Disclosed:

Oct 29, 2024

CVE-2024-50418 on NVD →

The Time Slot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 1.3.6

Fixed in:

1.3.7

Disclosed:

Oct 24, 2024

CVE-2024-50418 on NVD →