Skip to content
OpenAdvisories

Vendor

ameliabooking

20 known vulnerabilities.

Products

Booking for Appointments and Events Calendar – Amelia 13 Amelia 4 Booking System Trafft 3
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2026-39487

    WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.1.1.

    ameliabooking Amelia
  • High 8.8
    CVE-2026-5465 Public exploit

    Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

    The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the …

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 8.8
    CVE-2026-2931 Public exploit

    Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

    The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system re…

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 7.2
    CVE-2026-24963

    WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in ameliabooking Amelia ameliabooking allows Privilege Escalation.This issue affects Amelia: from n/a through <= 1.2.38.

    ameliabooking Amelia
  • High 7.5
    CVE-2025-12482

    Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search

    The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of suffi…

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 7.2
    CVE-2022-0834

    Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName

    The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject a…

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS