Skip to content
OpenAdvisories

Vendor

melograno

10 known vulnerabilities.

Products

Booking for Appointments and Events Calendar – Amelia 9 The Innovative Form Builder – IvyForms 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-109384 Public exploit

    The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload

    The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a …

    melograno The Innovative Form Builder – IvyForms Web / CMS
  • Critical 9.8
    CVE-2026-9055 Public exploit

    Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'

    The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update e…

    melograno Booking for Appointments and Events Calendar – Amelia Web / CMS