This vulnerability (CVE-2026-39447) is an instance of CWE-79, improper neutralization of input during web page generation, leading to cross-site scripting (XSS) in Simply Schedule Appointments software by NSquared. It affects versions up to and including 1.6.10.6. The vulnerability is exploitable without authentication and can be triggered remotely over the network with low attack complexity and no privileges required. The CVSS 3.1 base score is 7.1, reflecting a high severity with impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data disclosure, modification, or disruption of service. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users of affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying web application firewalls or input validation controls as temporary mitigations. Monitor vendor communications for updates on patches or official mitigations.