CVE-2022-0616

The CVE refers to the Amelia WordPress plugin before 1.0.47, which lacks a CSRF check when deleting customers. The underlying issue is CSRF protection absent for the delete customer action, enabling a logged-in administrator to delete arbitrary customers via CSRF. Affected component: Amelia WordP...

CVE-2022-0687

Affected software: Amelia WordPress plugin (prior to 1.0.47). Vulnerability summary: Stores image blobs into actual files with a user-controlled extension, which may allow uploading of PHP backdoors. Impact (as stated): PHP backdoors on the site when exploited by a logged-in user (Amelia Manager ...

CVE-2022-0837

The CVE concerns the Amelia WordPress plugin (before 1.0.48) with an authorization flaw in the Amelia SMS service. The vulnerability allows any authenticated customer to perform paid test SMS notifications and to access admin data (email, balance, and payment history), enabling account draining b...

CVE-2024-22298

CVE-2024-22298 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Amelia Booking. The affected versions are Amelia Booking ≤ 1.0.98, with unauthenticated attackers able to access restricted actions due to missing authorization checks. Patchstack notes ...

CVE-2022-0627

The CVE-2022-0627 entry concerns the Amelia WordPress plugin, where versions prior to 1.0.47 do not sanitize/escape the code parameter when outputting on an admin page, enabling a Reflected XSS. Red Hat and CVE records corroborate the vulnerability; PoCs and vendor advisories show affected versio...

CVE-2022-0720

CVE-2022-0720 affects the WordPress Amelia plugin prior to 1.0.47. The described vulnerability is improper authorization when managing appointments, allowing any customer to update someone else’s booking and to retrieve sensitive information (full name and phone number). The issue is supported by...

CVE-2022-0825

CVE-2022-0825 affects the WordPress Amelia plugin prior to 1.0.49. The vulnerability stems from improper authorization, enabling any authenticated customer to update other people’s booking status and to retrieve sensitive booking data (e.g., full name and phone number). This could lead to arbitra...

CVE-2024-6225

CVE-2024-6225 concerns the Booking for Appointments and Events Calendar – Amelia WordPress plugin, with a Stored XSS vulnerability exploitable by an attacker with administrator-level permissions (and higher) via admin settings. The issue affects multisite installations and sites where unfiltered_...

CVE-2023-27918

The CVE-2023-27918 entry concerns a cross-site scripting (XSS) vulnerability in the WordPress plugin “Appointment and Event Booking Calendar for WordPress - Amelia.” Affected version range is Amelia prior to 1.0.76. The underlying issue is a failure to sanitize/escape user-controlled input, enabl...

CVE-2023-29427

CVE-2023-29427 – Amelia WordPress plugin : Unauthenticated Reflected Cross-Site Scripting (XSS) in the TMS Booking for Appointments and Events Calendar. Affected versions: Amelia plugin

CVE-2023-6808

CVE-2023-6808 affects the WordPress plugin “Booking for Appointments and Events Calendar – Amelia.” The issue is stored cross-site scripting via the plugin’s shortcode attributes due to insufficient input sanitization and output escaping on user-supplied data. It can allow authenticated attackers...

CVE-2023-50860

CVE-2023-50860 is a Stored XSS in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, affecting Amelia Booking versions up to 1.0.85. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious input to be reflected and...