Ameliabooking Booking For Appointments And Events Calendar Amelia vulnerabilities

CVE-2026-2931 [HIGH] CWE-269 CVE-2026-2931: The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versio The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or a

CVE-2026-5465 [HIGH] CWE-639 CVE-2026-5465: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Inse The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the `externalId` field when a Provider (Employee) user updates their own profile. The `externalId` m

CVE-2025-12482 [HIGH] CWE-89 CVE-2025-12482: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attacker

CVE-2026-4668 [MEDIUM] CWE-89 CVE-2026-4668: The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied `sort` parameter and lack of sufficient preparation on the existing SQL query in `Pa

CVE-2024-6332 [MEDIUM] CWE-862 CVE-2024-6332: The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it possible for unauthenticated attackers to access employee

CVE-2026-6449 [MEDIUM] CWE-285 CVE-2026-6449: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Impr The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unau

CVE-2025-14720 [MEDIUM] CWE-862 CVE-2025-14720: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unau The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it possible for unauthenticated attackers to mark payments as refunded, trigger sending of queued notifications (emails/

CVE-2024-6552 [MEDIUM] CWE-200 CVE-2024-6552: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web applicatio

CVE-2025-2578 [MEDIUM] CWE-200 CVE-2025-2578: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable t The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The informat

CVE-2022-0834 [MEDIUM] CWE-79 CVE-2022-0834: The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and s The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar w

CVE-2023-6808 [MEDIUM] CWE-79 CVE-2023-6808: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stor The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor

CVE-2024-1484 [MEDIUM] CWE-79 CVE-2024-1484: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Refl The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that

CVE-2024-6225 [MEDIUM] CWE-79 CVE-2024-6225: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stor The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 (and 7.5.1 for the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve