The Easy Appointments WordPress plugin fails to validate shortcode input correctly when rendering blocks. It examines only the first tag of the supplied string against an allowlist while rendering the entire string, which allows users who have contributor-level permissions to execute any registered shortcode. The primary impact is that an authenticated contributor can run arbitrary plugin‑defined shortcodes that may perform privileged operations or expose sensitive data.

WordPress sites that are running Easy Appointments before version 3.12.28 are affected. The plugin, developed by an unknown vendor and listed in the WordPress plugin repository, is the target of this vulnerability.

The CVSS score of 2.7 indicates a low severity, and the EPSS score is < 1%, indicating a very low exploitation probability. The flaw is not listed in CISA’s KEV catalog, suggesting it is not known to be actively exploited. The likely attack vector is an authenticated contributor who logs into the site and inserts a malicious shortcode during content editing or via a visual editor. Because the allowlist is bypassed, the attacker can trigger privileged plugin behavior, potentially compromising site integrity and data confidentiality. The low EPSS score suggests that exploitation is unlikely at present.