Released Version 3.12.28 Easy Appointments
Released Date : 04 July 2026
Here’s the changelog:
- Fixed Security issue: missing authorization on customer listing AJAX handler allowing PII exposure. Reported by Mustafa Ahmed
- Fixed Security issue: missing authorization allowing bulk cancellation of appointments (CVE-2026-11992). Reported by Wordfence (armx64).
- Fixed Security issue: missing authorization on customer/appointment/connection AJAX handlers allowing data exposure and manipulation. Reported by Wordfence (Ryoma Nishioka, Vamshi Krishna Upadrasta).
- Fixed Security issue: missing authorization allowing Contributor-level read/modify/delete of appointments. Reported by Youssef massoudi.
- Fixed Security issue: missing authorization allowing deletion of booking connections. Reported by WEI HSIANG WANG.
- Fixed Security issue: missing ownership check allowing disclosure of customer personal data. Reported by Mark Moore.
- Fixed Security issue: missing ownership check allowing cross-user appointment modification. Reported by Duy Tran.
- Fixed Security issue: missing authorization on calendar REST endpoint and shortcode allowlist bypass. Reported by Phyo Ko Ko.
- Added TinyMCE Editor to Service Description and Support #service_description# Email Tag #270
- Fixed Multiple services in shortcode not working #276
- Fixed Vacation Time Which Allows Service Bookings That Overlap Vacation Hours #286
- Fixed Label click not working (for issue) in Settings #297
- Added Multiple deletion in location #294
- Added Multiple deletion in services #295
- Added Multiple deletion in employee #296
- Added Search filter with text in employee location and services #298
- Added a webhook to receive update about bookings #258
- Code improvements #305