Wappointment vulnerabilities

The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.

The Wappointment plugin for WordPress up to version 2.7.6 contains an Insecure Direct Object Reference (IDOR) vulnerability. The authorization key `edit_key` is generated as a predictable, unsalted MD5 hash of a sequential client ID, a publicly observable timestamp, and a small staff ID, allowing unauthenticated attackers to compute it and cancel or reschedule other users' appointments.

Missing Authorization vulnerability in Wappointment team Wappointment allows exploiting incorrectly configured access control security levels. This issue affects Wappointment through <= 2.7.6.

The Wappointment plugin (versions up to and including 2.6.9) contains a stored XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts.