Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14311)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that user had made an Amelia booking. This vulnerability affects only the Premium version of the plugin, where…
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14311
Risk Score
Threat Entry
Updated 2026-09-18
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-16582)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-16582
Risk Score
Threat Entry
Updated 2026-09-14
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-10148)
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-10148
Risk Score
Threat Entry
Updated 2026-09-14
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-77705)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-77705
Risk Score
Threat Entry
Updated 2026-09-14
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-77689)
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-77689
Risk Score
Threat Entry
Updated 2026-09-03
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14215)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14215
Risk Score
Threat Entry
Updated 2026-09-02
Booking For Appointments And Events Calendar - Privilege Escalation (CVE-2026-9055)
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a…
PLUGIN
Booking For Appointments And Events Calendar
CVE-2026-9055
Risk Score
Threat Entry
Updated 2026-08-31
Booking for Appointments and Events Calendar - Broken Access Control (CVE-2026-77704)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-77704
Risk Score
Threat Entry
Updated 2026-08-28
Booking for Appointments and Events Calendar - Authentication Bypass (CVE-2026-6286)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitize_text_field() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a…
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-6286
Risk Score
Threat Entry
Updated 2026-08-26
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14216)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14216
Risk Score
Threat Entry
Updated 2026-08-26
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14212)
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14212
Risk Score
Threat Entry
Updated 2026-08-26
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14213)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14213
Risk Score
Threat Entry
Updated 2026-08-26
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14211)
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14211
Risk Score
Threat Entry
Updated 2026-08-26
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-14214)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-14214
Risk Score
Threat Entry
Updated 2026-07-17
Booking For Appointments And Events Calendar - SQL Injection (CVE-2026-14782)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with wpamelia-manager role, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Booking For Appointments And Events Calendar
CVE-2026-14782
Risk Score
Threat Entry
Updated 2026-06-17
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-6449)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-6449
Risk Score
Threat Entry
Updated 2026-06-17
Booking for Appointments and Events Calendar - Security Vulnerability (CVE-2026-5465)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the `externalId` field when a Provider (Employee) user updates their own profile. The `externalId` maps directly to a WordPress user ID and is passed to `wp_set_password()` and `wp_update_user()` without authorization checks. This makes it possible for authenticated attackers, with Provider-level (Employee) access and above, to take over any WordPress account — including…
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-5465
Risk Score
Threat Entry
Updated 2026-06-17
Booking for Appointments and Events Calendar - SQL Injection (CVE-2026-4668)
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied `sort` parameter and lack of sufficient preparation on the existing SQL query in `PaymentRepository.php`, where the sort field is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also skip Amelia's nonce…
PLUGIN
Booking for Appointments and Events Calendar
CVE-2026-4668
Risk Score
Threat Entry
Updated 2026-06-17
Booking For Appointments And Events Calendar - Broken Access Control (CVE-2025-14720)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it possible for unauthenticated attackers to mark payments as refunded, trigger sending of queued notifications (emails/SMS/WhatsApp), and access debug information among other things.
PLUGIN
Booking For Appointments And Events Calendar
CVE-2025-14720
Risk Score
Threat Entry
Updated 2026-06-17
Booking For Appointments And Events Calendar - SQL Injection (CVE-2025-12482)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Booking For Appointments And Events Calendar
CVE-2025-12482
Risk Score