Ameliabooking Amelia vulnerabilities

• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint CVE-2026-107616 7.5 HighNovember 7, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint CVE-2026-104992 6.5 MediumNovember 7, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter CVE-2026-103915 5.3 MediumOctober 31, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability CVE-2026-116388 5.3 MediumOctober 26, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability CVE-2026-116396 6.5 MediumOctober 26, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability CVE-2026-112327 9.3 CriticalOctober 22, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability CVE-2026-108497 9.3 CriticalOctober 15, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability CVE-2026-109684 5.3 MediumOctober 13, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability CVE-2026-96461 7.5 HighOctober 9, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass CVE-2026-16582 5.3 MediumSeptember 17, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover CVE-2026-14311 5.4 MediumSeptember 17, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter CVE-2026-10148 6.4 MediumSeptember 12, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability CVE-2026-62112 7.6 HighSeptember 11, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' CVE-2026-9055 Public exploit 9.8 CriticalSeptember 2, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission CVE-2026-6286 7.2 HighAugust 28, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import CVE-2026-14782 4.9 MediumJuly 16, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability CVE-2026-57702 9.3 CriticalJuly 13, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability CVE-2026-48889 8.8 HighJune 15, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability CVE-2026-40795 6.5 MediumJune 15, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability CVE-2026-40789 7.5 HighJune 15, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint CVE-2026-6449 5.3 MediumMay 2, 2026
• ameliabooking amelia WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability CVE-2026-39487 7.6 HighApril 8, 2026
• ameliabooking booking for appointments and events calendar – amelia Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter CVE-2026-5465 Public exploit 8.8 HighApril 7, 2026
• ameliabooking booking for appointments and events calendar – amelia Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter CVE-2026-4668 6.5 MediumMarch 31, 2026
• ameliabooking booking for appointments and events calendar – amelia Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change CVE-2026-2931 Public exploit 8.8 HighMarch 26, 2026
• ameliabooking amelia WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability CVE-2026-24963 7.2 HighMarch 5, 2026
• ameliabooking amelia WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability CVE-2026-24967 5.3 MediumFebruary 3, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions CVE-2025-14720 5.3 MediumJanuary 9, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search CVE-2025-12482 7.5 HighNovember 16, 2025
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure CVE-2025-2578 5.3 MediumMarch 28, 2025
• ameliabooking amelia WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-26965 5.3 MediumFebruary 25, 2025
• ameliabooking booking for appointments and events calendar – amelia, tmsproducts amelia, amelia booking for appointments and events calendar – amelia pro +2 more Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure CVE-2024-6332 6.5 MediumSeptember 5, 2024
• ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 more Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure CVE-2024-6552 5.3 MediumAugust 8, 2024
• ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia, amelia booking for appointments and events calendar – amelia pro +2 more Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-6225 4.4 MediumJune 21, 2024
• ameliabooking amelia WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability CVE-2024-22298 5.3 MediumJune 10, 2024
• ameliabooking amelia WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31425 5.4 MediumApril 15, 2024
• ameliabooking booking for appointments and events calendar – amelia, tmsproducts amelia +1 more Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting CVE-2024-1484 6.1 MediumMarch 13, 2024
• ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 more Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-6808 6.4 MediumFebruary 5, 2024
• ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 more WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS) CVE-2023-50860 6.5 MediumDecember 28, 2023
• ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 more WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS) CVE-2023-29427 7.1 HighJune 26, 2023
• ameliabooking amelia Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure CVE-2022-0837 5.4 MediumApril 4, 2022
• wpamelia amelia, ameliabooking booking for appointments and events calendar – amelia +1 more Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName CVE-2022-0834 7.2 HighMarch 23, 2022