Skip to content
OpenAdvisories

Vendor

melograno

10 known vulnerabilities.

Products

Booking for Appointments and Events Calendar – Amelia 9 The Innovative Form Builder – IvyForms 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-107616

    Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

    The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `…

    melograno Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 8.8
    CVE-2026-109384 Public exploit

    The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload

    The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a …

    melograno The Innovative Form Builder – IvyForms Web / CMS
  • High 7.2
    CVE-2026-6286

    Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission

    The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand expli…

    melograno Booking for Appointments and Events Calendar – Amelia Web / CMS