ameliabooking vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20246
3. 20254
4. 20269

Newest CVEs

• CVE-2026-8791

  Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting

  ameliabooking · Booking System Trafft

  Medium6.4
• CVE-2026-6449

  Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint

  ameliabooking · Booking for Appointments and Events Calendar – Amelia

  Medium5.3
• CVE-2026-39487

  WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability

  ameliabooking · Amelia

  High7.6
• CVE-2026-5465

  Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

  ameliabooking · Booking for Appointments and Events Calendar – Amelia

  High8.8
• CVE-2026-4668

  Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter

  ameliabooking · Booking for Appointments and Events Calendar – Amelia

  Medium6.5
• CVE-2026-2931

  Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

  ameliabooking · Booking for Appointments and Events Calendar – Amelia

  High8.8
• CVE-2026-24963

  WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability

  ameliabooking · Amelia

  High7.2
• CVE-2026-24967

  WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability

  ameliabooking · Amelia

  Medium5.3
• CVE-2025-14720

  Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions

  ameliabooking · Booking for Appointments and Events Calendar – Amelia

  Medium5.3
• CVE-2025-12482

  Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search

  ameliabooking · Booking for Appointments and Events Calendar – Amelia

  High7.5