VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Booking for Appointments and Events Calendar – Amelia security & vulnerabilities

ameliabooking— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 57 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
57Known vulnerabilities
  • Critical1
  • High12
  • Medium44
  • Low0
Vulnerabilities per year
2022: 7 vulnerabilities7222023: 2 vulnerabilities2232024: 7 vulnerabilities7242025: 4 vulnerabilities4252026: 37 vulnerabilities3726

All Booking for Appointments and Events Calendar – Amelia vulnerabilities

Booking for Appointments and Events Calendar – Amelia vulnerabilities
SeverityVulnerabilityCVEPublished
High7.5Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint
9.0 – 9.9.1Update to 9.9.2
CVE-2026-107616
Medium6.5Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint
9.0 – 9.9.1Update to 9.9.2
CVE-2026-104992
Medium5.3Unauthenticated Sensitive Information Exposure in 'page' Parameter
≤2.4.12Update to 2.4.13
CVE-2026-103915
Medium5.3Missing Authorization
≤2.4.10Update to 2.4.11
CVE-2026-116388
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.12Update to 2.4.13
CVE-2026-116396
High7.5Unauthenticated SQL Injection
≤2.4.11Update to 2.4.12
CVE-2026-112327
High7.5Unauthenticated SQL Injection
≤2.4.10Update to 2.4.11
CVE-2026-108497
Medium5.3Missing Authorization
≤2.4.10Update to 2.4.11
CVE-2026-109684
Medium5.3Missing Authorization
≤2.4.10Update to 2.4.11
CVE-2026-96461
Medium5.4Authenticated (Custom+) Missing Authorization to Limited Account Takeover
≤2.4.4Update to 2.4.5
CVE-2026-14311
Medium5.3Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
≤2.4.5Update to 2.4.6
CVE-2026-16582
Medium6.3Authenticated (Custom Role+) Privilege Escalation
<2.4.10Update to 2.4.10
CVE-2026-77705
Medium4.9Authenticated (Editor+) SQL Injection
≤2.4.9Update to 2.4.10
CVE-2026-62112
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
≤2.4.9Update to 2.4.10
CVE-2026-10148
Medium5.39.8.0 - Unauthenticated Payment Bypass
9.0 – 9.8.0Update to 9.8.1
CVE-2026-77689
Critical9.89.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
8.0 – 9.6.2Update to 9.6.3
CVE-2026-9055
Medium5.3Missing Authorization
<2.4.9Update to 2.4.9
CVE-2026-14215
Medium4.32.4.8 - Missing Authorization
1.2.32 – 2.4.8Update to 2.4.9
CVE-2026-77704
Medium6.39.7 - Authenticated (Provider+) Arbitrary Provider Password Update
9.0 – 9.7Update to 9.8
CVE-2026-14212
High7.2Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
≤2.2Update to 2.2.1
CVE-2026-6286
Medium5.3Missing Authorization
<2.4.7Update to 2.4.7
CVE-2026-14216
Medium4.3Authenticated (Custom role+) Information Exposure
<2.4.6Update to 2.4.6
CVE-2026-14213
Medium4.3Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure
≤9.6Update to 9.7
CVE-2026-14211
Medium4.3Missing Authorization
<2.4.4Update to 2.4.4
CVE-2026-14214
Medium4.9Authenticated (Custom+) SQL Injection via Customer Import
≤2.4.3Update to 2.4.4
CVE-2026-14782
High7.5Unauthenticated SQL Injection
≤2.4.2Update to 2.4.3
CVE-2026-57702
High8.8Authenticated (Subscriber+) Privilege Escalation
≤2.3Update to 2.4
CVE-2026-48889
Medium5.3Unauthenticated Authorization Bypass via Remote Approval Endpoint
≤2.2.1Update to 2.3
CVE-2026-6449
Medium4.3Missing Authorization
≤2.2Update to 2.2.1
CVE-2026-40795
Medium5.3Unauthenticated Information Exposure
≤2.2Update to 2.2.1
CVE-2026-40789
High8.8Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
≤2.1.3Update to 2.2
CVE-2026-5465
Medium6.5Authenticated (Manager+) SQL Injection via 'sort' Parameter
≤2.1.2Update to 2.1.3
CVE-2026-4668
High8.89.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
8.3 – 9.1.2Update to 9.2
CVE-2026-2931
Medium6.5Authenticated (Custom role+) SQL Injection
≤2.1.1Update to 2.1.2
CVE-2026-39487
High8.8Authenticated (Employee+) Privilege Escalation
≤1.2.38Update to 2.0
CVE-2026-24963
Medium5.3Missing Authorization
≤1.2.38Update to 2.0
CVE-2026-24967
Medium5.3Missing Authorization to Unauthenticated Multiple AJAX Actions
≤1.2.38Update to 2.0.0
CVE-2025-14720
Medium5.31.2.36 - Unauthenticated Sensitive Information Exposure
1.2.18 – 1.2.36Update to 1.2.37
CVE-2023-49282
High7.5Unauthenticated SQL Injection via search
≤1.2.35Update to 1.2.36
CVE-2025-12482
Medium5.3Unauthenticated Full Path Disclosure
≤1.2.19Update to 1.2.20
CVE-2025-2578
Medium5.3Unauthenticated Insecure Direct Object Reference
≤1.2.16Update to 1.2.17
CVE-2025-26965
Medium6.5Missing Authorization to Sensitive Information Exposure
≤7.7Update to 7.8
CVE-2024-6332
Medium5.3Unauthenticated Full Path Disclosure
≤1.2Update to 1.2.1
CVE-2024-6552
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤7.5.1Update to 7.6
CVE-2024-6225
Medium4.3Cross-Site Request Forgery
≤1.0.95Update to 1.0.96
CVE-2024-31425
Medium6.1Reflected Cross-Site Scripting
≤1.0.98Update to 1.0.99
CVE-2024-1484
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
≤1.0.93Update to 1.0.94
CVE-2023-6808
Medium6.5Missing Authorization
≤1.0.98Update to 1.0.99
CVE-2024-22298
Medium6.4Stored Cross-Site Scripting via Shortcode
≤1.0.85Update to 1.0.86
CVE-2023-50860
Medium6.1Unauthenticated Reflected Cross-Site Scripting via 'code'
≤1.0.75Update to 1.0.76
CVE-2023-29427
Medium5.4Arbitrary Booking Update and Sensitive Data Exposure
<1.0.49Update to 1.0.49
CVE-2022-0825
Medium6.4Information Disclosure and SMS Spam
<1.0.48Update to 1.0.48
CVE-2022-0837
High7.2Stored Cross Site Scripting via lastName
≤1.0.46Update to 1.0.47
CVE-2022-0834
Medium5.4Amelia < 1.0.47 - Arbitrary Booking Update and Sensitive Data Exposure
<1.0.47Update to 1.0.47
CVE-2022-0720
Medium4.3Cross-Site Request Forgery
≤1.0.46Update to 1.0.47
CVE-2022-0616
Medium6.1Reflected Cross-Site Scripting
≤1.0.46Update to 1.0.47
CVE-2022-0627
High8.8Amelia < 1.0.47 - Arbitrary File Upload
<1.0.47Update to 1.0.47
CVE-2022-0687

Booking for Appointments and Events Calendar – Amelia: common questions

Does Booking for Appointments and Events Calendar – Amelia have known vulnerabilities?

Yes. VulnCrest Radar lists 57 known vulnerabilities in Booking for Appointments and Events Calendar – Amelia: 1 critical, 12 high, 44 medium. None are known to affect version null.

How do I check which version of Booking for Appointments and Events Calendar – Amelia I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Booking for Appointments and Events Calendar – Amelia vulnerability?

CVE-2026-107616, published Nov 6, 2026: Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint. Severity: High (CVSS 7.5).

Is any Booking for Appointments and Events Calendar – Amelia vulnerability listed in CISA KEV?

No. None of the known Booking for Appointments and Events Calendar – Amelia vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?