# cve.now: Croixhaug

The newest entries naming Croixhaug as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104000](https://cve.now/CVE-2026-104000.md): Simply Schedule Appointments \<= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} (CVSS 7.2)
- [CVE-2026-6723](https://cve.now/CVE-2026-6723.md): Appointment Booking Calendar \<= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token (CVSS 5.3)
- [CVE-2026-91109](https://cve.now/CVE-2026-91109.md): Simply Schedule Appointments \<= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete\_group' Parameter (CVSS 6.5)
- [CVE-2026-92245](https://cve.now/CVE-2026-92245.md): Simply Schedule Appointments \<= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment\_types REST Endpoint via Public Nonce (CVSS 7.5)
- [CVE-2026-89294](https://cve.now/CVE-2026-89294.md): Simply Schedule Appointments \<= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa\_locale' Parameter (CVSS 7.5)
- [CVE-2026-13358](https://cve.now/CVE-2026-13358.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 6.5)
- [CVE-2026-6937](https://cve.now/CVE-2026-6937.md): Appointment Booking Calendar \<= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint (CVSS 5.3)
- [CVE-2026-7797](https://cve.now/CVE-2026-7797.md): Appointment Booking Calendar \<= 1.6.11.8 - Unauthenticated SQL Injection via 'append\_where\_sql' Parameter (CVSS 7.5)
- [CVE-2026-7493](https://cve.now/CVE-2026-7493.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.11.5 - Unauthenticated Denial of Service (CVSS 5.3)
- [CVE-2026-4807](https://cve.now/CVE-2026-4807.md): Appointment Booking Calendar \<= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion (CVSS 6.5)
- [CVE-2026-3658](https://cve.now/CVE-2026-3658.md): Appointment Booking Calendar \<= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter (CVSS 7.5)
- [CVE-2026-1704](https://cve.now/CVE-2026-1704.md): Appointment Booking Calendar \<= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2026-3045](https://cve.now/CVE-2026-3045.md): Appointment Booking Calendar \<= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint (CVSS 7.5)
- [CVE-2026-1708](https://cve.now/CVE-2026-1708.md): Appointment Booking Calendar \<= 1.6.9.27 - Unauthenticated SQL Injection via 'append\_where\_sql' Parameter (CVSS 7.5)
- [CVE-2025-12166](https://cve.now/CVE-2025-12166.md): Simply Schedule Appointments \<= 1.6.9.9 - Unauthenticated SQL Injection via \`order\` and \`append\_where\_sql\` Parameters (CVSS 7.5)
- [CVE-2025-11723](https://cve.now/CVE-2025-11723.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.9.5 - Unauthenticated Sensitive Information Exposure (CVSS 6.5)
- [CVE-2025-13754](https://cve.now/CVE-2025-13754.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-4667](https://cve.now/CVE-2025-4667.md): Simply Schedule Appointments \<= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4)
- [CVE-2025-1119](https://cve.now/CVE-2025-1119.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-13431](https://cve.now/CVE-2024-13431.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.8.3 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-4288](https://cve.now/CVE-2024-4288.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2341](https://cve.now/CVE-2024-2341.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8)
- [CVE-2024-2342](https://cve.now/CVE-2024-2342.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8)
- [CVE-2024-1760](https://cve.now/CVE-2024-1760.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset (CVSS 4.3)
- [CVE-2023-2764](https://cve.now/CVE-2023-2764.md): Draw Attention \<= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/croixhaug
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.