Booking for Appointments and Events Calendar – Amelia

Уязвимости

• CVE-2024-22298без авторизации≤ 1.0.98

  WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability

  Критич. 9.8

• CVE-2026-57702без авторизации≤ 2.4.2

  WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-48889подписчик+≤ 2.3

  WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability

  Высокий 8.8

• CVE-2026-5465нужен вход≤ 2.1.3

  Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

  Высокий 8.8

• CVE-2026-2931клиент+≤ 9.1.2

  Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

  Высокий 8.8

• CVE-2026-62112редактор+≤ 2.4.9

  WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

  Высокий 7.6

• CVE-2026-39487высокие права≤ 2.1.1

  WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability

  Высокий 7.6

• CVE-2026-40789без авторизации≤ 2.2

  WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability

  Высокий 7.5

• CVE-2025-12482без авторизации≤ 1.2.35

  Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search

  Высокий 7.5

• CVE-2026-6286без авторизации≤ 2.2

  Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission

  Высокий 7.2

• CVE-2026-24963высокие права≤ 1.2.38

  WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability

  Высокий 7.2

• CVE-2024-6332без авторизации≤ 7.7

  Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure

  Средний 6.5

• CVE-2026-40795подписчик+≤ 2.2

  WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2026-4668нужен вход≤ 2.1.2

  Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter

  Средний 6.5

• CVE-2026-10148участник+≤ 2.4.9

  Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter

  Средний 6.4

• CVE-2024-1484без авторизации · нужен клик≤ 1.0.98

  Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting

  Средний 6.1

• CVE-2023-29427без авторизации · нужен клик≤ 1.0.75

  WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2023-27918без авторизации · нужен клик

  Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote

  Средний 6.1

• CVE-2024-31425без авторизации · нужен клик≤ 1.0.95

  WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 5.4

• CVE-2023-50860нужен вход≤ 1.0.85

  WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)

  Средний 5.4

• CVE-2023-6808участник+≤ 1.0.93

  Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

  Средний 5.4

• CVE-2026-6449без авторизации≤ 2.1.2

  Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint

  Средний 5.3

• CVE-2026-24967без авторизации≤ 1.2.38

  WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2025-14720без авторизации≤ 1.2.38

  Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions

  Средний 5.3

• CVE-2025-2578без авторизации≤ 1.2.19

  Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure

  Средний 5.3

• CVE-2025-26965без авторизации≤ 1.2.16

  WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability

  Средний 5.3

• CVE-2024-6552без авторизации≤ 1.2

  Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure

  Средний 5.3

• CVE-2026-14782высокие права≤ 2.4.3

  Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import

  Средний 4.9

• CVE-2024-6225админ≤ 7.5.1

  Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting

  Средний 4.8