CVE-2026-9055

CVE-2026-9055 — Amelia Booking Plugin Unauthenticated Privilege Escalation Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for this vulnerability. An unauthenticated privilege escalation vulnerability in the Amelia Premium WordPress...

CVE-2026-5465

CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...

CVE-2026-116388

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-116396

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12...

CVE-2026-116388 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-116388

The Amelia (TMS ameliabooking) plugin for WordPress, versions up to and including 2.4.10 , is susceptible to a Missing Authorization vulnerability (CWE-862). The root cause is incorrectly configured access control security levels , which may allow for unauthorized access to specific functionaliti...

EUVD-2026-109990

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin Amelia versions = 2.4.10...

CVE-2026-116396 WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12...

CVE-2026-116396

The TMS Amelia ameliabooking WordPress plugin versions up to and including 2.4.12 are vulnerable to a Stored Cross-site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation , which allows an attacker to inject malicious scripts. While th...

EUVD-2026-109989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12...

WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Amelia versions = 2.4.12...

CVE-2026-112327

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...

EUVD-2026-108054

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...

CVE-2026-112327

The TMS Amelia (ameliabooking) WordPress plugin is vulnerable to a SQL Injection flaw (CWE-89) in versions 2.4.11 and below . The issue stems from the improper neutralization of special elements used in an SQL command, potentially allowing an attacker to execute arbitrary SQL queries. This vulner...

CVE-2026-112327 WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...

WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by SVO in WordPress Plugin Amelia versions = 2.4.11...

CVE-2026-108497

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...

EUVD-2026-102005

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-108497 WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...