Simply Schedule Appointments

1.6.12.13 – 2026-07-21

Handle Google Calendar invalid_grant: stop dead-token retries and flag staff needing reconnect

1.6.12.11 – 2026-07-14

Fix stored XSS via appointment meta javascript: URI

Fix Basic-edition upgrade-link CSS leaking into plugin-update AJAX responses

Harden booking endpoint against spam bookings.

Harden appointment meta links to allow only absolute http(s) URLs

Fix memory errors when loading large appointment date ranges, and reduce unnecessary Google Calendar cache rebuilds

Security: unauth SQLi route-casing bypass + Contributor IDOR on appointment shortcodes

Fix PayPal IPN listener: reject non-POST requests

1.6.12.8 – 2026-06-30

Fix purge appointments 500 on Basic/Plus/Pro editions (missing dependency models)

Require a non-zero “First Available within” duration (default 1 hour)

1.6.12.6 – 2026-06-23

PatchStack [Security][Broken Access Control] Simply Schedule Appointments plugin <= 1.6.12.0 is vulnerable to Broken Access Control

1.6.12.4 – 2026-06-16

Restore webhook price fields in SSA appointment payloads

Security: stored XSS via nested customer_information array (Patchstack)

Defend Google Calendar token expiry against host clock drift

Fix Zoom OAuth open redirect: use wp_safe_redirect

1.6.12.2 – 2026-06-09

Fix IDOR in MemberPress user appointment REST endpoints

fix: neutralize CSV formula injection in appointment backup exporter

Fix SSA module missing from Divi 5 picker with a child theme active

1.6.12.0 – 2026-06-04

Remove publ