The Easy Appointments WordPress plugin fails to correctly validate shortcode input; it checks only the first tag of the supplied string against an allowlist while rendering the entire string. This flaw allows users who have contributor-level access to execute any registered shortcode. The primary impact is that an attacker can run arbitrary plugin-defined shortcodes that may perform privileged operations or expose sensitive data.

WordPress sites that are running Easy Appointments version 3.12.26 or earlier are affected. The plugin, developed by an unknown vendor and listed in the WordPress plugin repository, is the target of this vulnerability.

The CVSS score of 2.7 indicates a low severity, and no EPSS information is available. The flaw is not listed in CISA’s KEV catalog, suggesting it is not known to be actively exploited. The likely attack vector is an authenticated contributor who logs into the site and inserts a malicious shortcode during content editing or via a visual editor. Because the allowlist is bypassed, the attacker can trigger privileged plugin behavior, potentially compromising site integrity and data confidentiality. XPSS would likely be low given the lack of public exploitation reports.