Aameliabooking

Products

Exploited and recent CVEs

• CVE-2026-8791 Medium 6.4 Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.4%
• CVE-2026-6449 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint 0.5%
• CVE-2026-39487 High 7.6 WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability 0.3%
• CVE-2026-5465 High 8.8 Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter 0.6%
• CVE-2026-4668 Medium 6.5 Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter 0.4%
• CVE-2026-2931 High 8.8 Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change 0.5%
• CVE-2026-24963 High 7.2 WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability 0.4%
• CVE-2026-24967 Medium 5.3 WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability 0.3%
• CVE-2025-14720 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions 0.3%
• CVE-2025-12482 High 7.5 Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search 0.3%
• CVE-2025-58213 Medium 6.5 WordPress Booking System Trafft Plugin <= 1.0.14 - Cross Site Scripting (XSS) Vulnerability 0.2%
• CVE-2025-2578 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure 0.4%
• CVE-2025-26965 Medium 5.3 WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability 0.4%
• CVE-2024-11754 Medium 6.4 Booking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-6332 Medium 6.5 Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure 0.4%
• CVE-2024-6552 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure 0.4%
• CVE-2024-6225 Medium 4.4 Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting 0.3%
• CVE-2024-1484 Medium 6.1 Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting 0.5%
• CVE-2023-6808 Medium 6.4 Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode 0.5%
• CVE-2022-0834 High 7.2 Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName 0.5%