170 matches found
CVE-2026-5465
CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...
CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability
Editor SQL Injection in Amelia = 2.4.9 versions...
CVE-2026-6286 Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...
CVE-2026-14214 Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
WordPress Booking for Appointments and Events Calendar plugin < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification vulnerability
Amelia Manager+ Arbitrary User-Field Modification vulnerability discovered by Manuel Martínez Casasola in WordPress Plugin Amelia versions 2.4.4...
EUVD-2026-45051
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782 Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782 Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782
The CVE-2026-14782 entry concerns the Booking for Appointments and Events Calendar – Amelia plugin for WordPress. A SQL Injection exists via the Customer Import feature in all versions up to and including 2.4.3, due to insufficient escaping of the user-supplied parameter and inadequate preparatio...
PT-2026-60589
Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia versions prior to 2.4.4 Description An issue exists in the Customer Import feature where insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries...
CVE-2026-57702 WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through = 2.4.2...
CVE-2026-57702 WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through = 2.4.2...
CVE-2026-57702
The WordPress Amelia plugin (Amelia ameliabooking)
WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin Amelia versions = 2.4.2...
CVE-2026-48889
The CVE-2026-48889 entry concerns the WordPress Amelia plugin (versions <= 2.3) with a privilege escalation vulnerability affecting subscribers. The attached metrics indicate a high severity (CVSS v3.1 base score 8.8) with network attack vector, low attack complexity, and privileges required a...
CVE-2026-48889 WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Amelia = 2.3 versions...