Booking for Appointments and Events Calendar

Software Type	Plugin
Software Slug	ameliabooking (view on wordpress.org)
Software Status	Active
Software Author	melograno
Software Website	wpamelia.com
Software Downloads	1,632,684
Software Active Installs	90,000
Software Record Last Updated	October 14, 2026

Showing 1-20 of 47 Vulnerabilities

Submit a Vulnerability

Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Missing Authorization

5.3

CVE-2026-96461

Oct 2, 2026

Researcher: Ananda Dhakal

Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover

5.4

CVE-2026-14311

Sep 17, 2026

Researcher: Jonah Burgess (CryptoCat)

Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass

5.3

CVE-2026-16582

Sep 17, 2026

Researcher: ricky morty

Booking for Appointments and Events Calendar – Amelia < 2.4.10 - Authenticated (Custom Role+) Privilege Escalation

6.3

CVE-2026-77705

Sep 14, 2026

Researcher: Karthik Ramakrishnan

Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Editor+) SQL Injection

4.9

CVE-2026-62112

Sep 11, 2026

Researcher: Ananda Dhakal

Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter

6.4

CVE-2026-10148

Sep 11, 2026

Researcher: Nguyen Anh Quan (prototw)

Booking for Appointments and Events Calendar – Amelia 9.0 - 9.8.0 - Unauthenticated Payment Bypass

5.3

CVE-2026-77689

Sep 10, 2026

Researcher: Pedro Pinho

Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'

9.8

CVE-2026-9055

Sep 1, 2026

Researcher: d.v4n_s3c

Booking for Appointments and Events Calendar – Amelia < 2.4.9 - Missing Authorization

5.3

CVE-2026-14215

Aug 31, 2026

Researcher: Haitam Lazaar

Booking for Appointments and Events Calendar – Amelia 1.2.32 - 2.4.8 - Missing Authorization

4.3

CVE-2026-77704

Aug 29, 2026

Researcher: Louise

Booking for Appointments and Events Calendar – Amelia 9.0 - 9.7 - Authenticated (Provider+) Arbitrary Provider Password Update

6.3

CVE-2026-14212

Aug 28, 2026

Researcher: Haitam Lazaar

Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission

7.2

CVE-2026-6286

Aug 27, 2026

Researcher: Lucas Montes (NiRoX)

Booking for Appointments and Events Calendar – Amelia < 2.4.7 - Missing Authorization

5.3

CVE-2026-14216

Aug 26, 2026

Researcher: Manuel Martínez Casasola

Booking for Appointments and Events Calendar – Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure

4.3

CVE-2026-14213

Aug 14, 2026

Researcher: Muni Nitish Kumar Yaddala

Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure

4.3

CVE-2026-14211

Aug 7, 2026

Researcher: Mustafa Ahmed

Booking for Appointments and Events Calendar – Amelia < 2.4.4 - Missing Authorization

4.3

CVE-2026-14214

Aug 1, 2026

Researcher: Manuel Martínez Casasola

Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import

4.9

CVE-2026-14782

Jul 16, 2026

Researcher: Fodhil Benhiba (F0DH1L)

Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection

7.5

CVE-2026-57702

Jul 8, 2026

Researcher: daroo

Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation

8.8

CVE-2026-48889

Jun 2, 2026

Researcher: dodoh4t

Booking for Appointments and Events Calendar – Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint

5.3

CVE-2026-6449

May 1, 2026

Researcher: awhacken

Title	Status	CVE ID	CVSS	Researchers	Date
Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Missing Authorization	Patched	CVE-2026-96461	5.3	Ananda Dhakal	October 2, 2026
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover	Patched	CVE-2026-14311	5.4	Jonah Burgess (CryptoCat)	September 17, 2026
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass	Patched	CVE-2026-16582	5.3	ricky morty	September 17, 2026
Booking for Appointments and Events Calendar – Amelia < 2.4.10 - Authenticated (Custom Role+) Privilege Escalation	Patched	CVE-2026-77705	6.3	Karthik Ramakrishnan	September 14, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Editor+) SQL Injection	Patched	CVE-2026-62112	4.9	Ananda Dhakal	September 11, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter	Patched	CVE-2026-10148	6.4	Nguyen Anh Quan (prototw)	September 11, 2026
Booking for Appointments and Events Calendar – Amelia 9.0 - 9.8.0 - Unauthenticated Payment Bypass	Patched	CVE-2026-77689	5.3	Pedro Pinho	September 10, 2026
Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'	Patched	CVE-2026-9055	9.8	d.v4n_s3c	September 1, 2026
Booking for Appointments and Events Calendar – Amelia < 2.4.9 - Missing Authorization	Patched	CVE-2026-14215	5.3	Haitam Lazaar	August 31, 2026
Booking for Appointments and Events Calendar – Amelia 1.2.32 - 2.4.8 - Missing Authorization	Patched	CVE-2026-77704	4.3	Louise	August 29, 2026
Booking for Appointments and Events Calendar – Amelia 9.0 - 9.7 - Authenticated (Provider+) Arbitrary Provider Password Update	Patched	CVE-2026-14212	6.3	Haitam Lazaar	August 28, 2026
Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission	Patched	CVE-2026-6286	7.2	Lucas Montes (NiRoX)	August 27, 2026
Booking for Appointments and Events Calendar – Amelia < 2.4.7 - Missing Authorization	Patched	CVE-2026-14216	5.3	Manuel Martínez Casasola	August 26, 2026
Booking for Appointments and Events Calendar – Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure	Patched	CVE-2026-14213	4.3	Muni Nitish Kumar Yaddala	August 14, 2026
Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure	Patched	CVE-2026-14211	4.3	Mustafa Ahmed	August 7, 2026
Booking for Appointments and Events Calendar – Amelia < 2.4.4 - Missing Authorization	Patched	CVE-2026-14214	4.3	Manuel Martínez Casasola	August 1, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import	Patched	CVE-2026-14782	4.9	Fodhil Benhiba (F0DH1L)	July 16, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection	Patched	CVE-2026-57702	7.5	daroo	July 8, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation	Patched	CVE-2026-48889	8.8	dodoh4t	June 2, 2026
Booking for Appointments and Events Calendar – Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint	Patched	CVE-2026-6449	5.3	awhacken	May 1, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation