CVE-2026-14225

LowCVSS 2.7

Published: 06/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 incorrectly validates shortcode input, allowing contributor-level users to execute arbitrary registered shortcodes.

Risk Assessment

Arbitrary shortcode execution may lead to unauthorized actions, such as content modification or malicious code injection.

Recommendation

Update the Easy Appointments plugin to version 3.12.28 or later.

Original NVD description (English source)

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.