ameliabooking vulnerabilities
20 published CVEs name ameliabooking among the affected products.
- 20Published CVEs20 of them scored
- 10Last 12 monthspublished in the last year
- 0Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-8791
Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
ameliabooking · Booking System Trafft
Medium6.4 - CVE-2026-6449
Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint
ameliabooking · Booking for Appointments and Events Calendar – Amelia
Medium5.3 - CVE-2026-39487
WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability
ameliabooking · Amelia
High7.6 - CVE-2026-5465
Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
ameliabooking · Booking for Appointments and Events Calendar – Amelia
High8.8 - CVE-2026-4668
Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
ameliabooking · Booking for Appointments and Events Calendar – Amelia
Medium6.5 - CVE-2026-2931
Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
ameliabooking · Booking for Appointments and Events Calendar – Amelia
High8.8 - CVE-2026-24963
WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability
ameliabooking · Amelia
High7.2 - CVE-2026-24967
WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability
ameliabooking · Amelia
Medium5.3 - CVE-2025-14720
Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions
ameliabooking · Booking for Appointments and Events Calendar – Amelia
Medium5.3 - CVE-2025-12482
Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search
ameliabooking · Booking for Appointments and Events Calendar – Amelia
High7.5