Skip to contentAmeliabooking Booking For Appointments And Events Calendar – Amelia vulnerabilities
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' EndpointCVE-2026-1076167.5 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' EndpointCVE-2026-1049926.5 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' ParameterCVE-2026-1039155.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment BypassCVE-2026-165825.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account TakeoverCVE-2026-143115.4 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' ParameterCVE-2026-101486.4 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'CVE-2026-9055Public exploit9.8 Critical
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking SubmissionCVE-2026-62867.2 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer ImportCVE-2026-147824.9 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval EndpointCVE-2026-64495.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' ParameterCVE-2026-5465Public exploit8.8 High
- ameliabooking booking for appointments and events calendar – ameliaAmelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' ParameterCVE-2026-46686.5 Medium
- ameliabooking booking for appointments and events calendar – ameliaAmelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password ChangeCVE-2026-2931Public exploit8.8 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX ActionsCVE-2025-147205.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via searchCVE-2025-124827.5 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path DisclosureCVE-2025-25785.3 Medium
- ameliabooking booking for appointments and events calendar – amelia, tmsproducts amelia, amelia booking for appointments and events calendar – amelia pro +2 moreBooking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information ExposureCVE-2024-63326.5 Medium
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 moreBooking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path DisclosureCVE-2024-65525.3 Medium
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia, amelia booking for appointments and events calendar – amelia pro +2 moreAmelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site ScriptingCVE-2024-62254.4 Medium
- ameliabooking booking for appointments and events calendar – amelia, tmsproducts amelia +1 moreBooking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site ScriptingCVE-2024-14846.1 Medium
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 moreBooking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeCVE-2023-68086.4 Medium
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 moreWordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)CVE-2023-508606.5 Medium
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 moreWordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)CVE-2023-294277.1 High
- wpamelia amelia, ameliabooking booking for appointments and events calendar – amelia +1 moreAmelia <= 1.0.46 - Stored Cross Site Scripting via lastNameCVE-2022-08347.2 High