WordPress plugin
Booking for Appointments and Events Calendar – Amelia security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 57 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High12
- Medium44
- Low0
All Booking for Appointments and Events Calendar – Amelia vulnerabilities
- High7.5Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint
9.0 – 9.9.1Update to 9.9.2
- High7.5Unauthenticated SQL Injection
≤2.4.11Update to 2.4.12
- High7.5Unauthenticated SQL Injection
≤2.4.10Update to 2.4.11
- Critical9.89.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
8.0 – 9.6.2Update to 9.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
≤2.2Update to 2.2.1
- High7.5Unauthenticated SQL Injection
≤2.4.2Update to 2.4.3
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤2.3Update to 2.4
- High8.8Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
≤2.1.3Update to 2.2
- High8.89.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
8.3 – 9.1.2Update to 9.2
- High8.8Authenticated (Employee+) Privilege Escalation
≤1.2.38Update to 2.0
- High7.5Unauthenticated SQL Injection via search
≤1.2.35Update to 1.2.36
- High7.2Stored Cross Site Scripting via lastName
≤1.0.46Update to 1.0.47
- High8.8Amelia < 1.0.47 - Arbitrary File Upload
<1.0.47Update to 1.0.47
Booking for Appointments and Events Calendar – Amelia: common questions
Does Booking for Appointments and Events Calendar – Amelia have known vulnerabilities?
Yes. VulnCrest Radar lists 57 known vulnerabilities in Booking for Appointments and Events Calendar – Amelia: 1 critical, 12 high, 44 medium. None are known to affect version null.
How do I check which version of Booking for Appointments and Events Calendar – Amelia I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Booking for Appointments and Events Calendar – Amelia vulnerability?
CVE-2026-107616, published Nov 6, 2026: Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint. Severity: High (CVSS 7.5).
Is any Booking for Appointments and Events Calendar – Amelia vulnerability listed in CISA KEV?
No. None of the known Booking for Appointments and Events Calendar – Amelia vulnerabilities is currently listed in the CISA KEV catalog.