ameliabooking Booking for Appointments and Events Calendar – Amelia

• CVE-2026-6449 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint 0.5%
• CVE-2026-5465 High 8.8 Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter 0.6%
• CVE-2026-4668 Medium 6.5 Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter 0.4%
• CVE-2026-2931 High 8.8 Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change 0.5%
• CVE-2025-14720 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions 0.3%
• CVE-2025-12482 High 7.5 Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search 0.3%
• CVE-2025-2578 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure 0.4%
• CVE-2024-6332 Medium 6.5 Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure 0.4%
• CVE-2024-6552 Medium 5.3 Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure 0.4%
• CVE-2024-6225 Medium 4.4 Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting 0.3%
• CVE-2024-1484 Medium 6.1 Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting 0.5%
• CVE-2023-6808 Medium 6.4 Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode 0.5%
• CVE-2022-0834 High 7.2 Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName 0.5%