CVE-2025-11723
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Jan 6, 2026
CISA due date
—
The record
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.5 via the hash() function due to use of a hardcoded fall-back salt. This makes it possible for unauthenticated attackers to generate a valid token across sites running the plugin that have not manually set a salt in the wp-config.php file and access booking information that will allow them to make modifications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79981 The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured… CWE-330
- CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by… CWE-330
- CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-330
- CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-330
- CVE-2026-55889 XDG Desktop Portal is a desktop integration portal. CWE-330
- CVE-2026-114576 A vulnerability has been found in Linksys RE6250 1.0.04.001. CWE-330
- CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-330
- CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current… CWE-330