CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (also known as Amelia ) versions before 2.4.9 is vulnerable to an unauthenticated post-booking action trigger. The root cause is a failure to require authentication or a valid request token before executing the post-booking action ...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

EUVD-2026-51932

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...