Plugin icon

Booking for Appointments and Events Calendar – Amelia

ameliabooking

Vulnerabilities:

25

Last Updated:

March 23, 2026

Active Installs:

90000

Published
Title
Fixed in
CVSS
Published
2026-03-31
Title
Amelia < 2.1.3 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
Fixed in
Fixed in 2.1.3
CVSS
6.5 (medium)
Published
2026-03-25
Title
Amelia Booking < 9.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
Fixed in
Fixed in 9.2
CVSS
8.8 (high)
Published
2026-03-04
Title
Amelia < 2.0 - Employee+ Privilege Escalation
Fixed in
Fixed in 2.0
CVSS
7.2 (high)
Published
2026-01-11
Title
Amelia < 2.0 - Missing Authorization
Fixed in
Fixed in 2.0
CVSS
5.3 (medium)
Published
2026-01-08
Title
Booking for Appointments and Events Calendar – Amelia < 2.0.0 - Missing Authorization to Unauthenticated Multiple AJAX Actions
Fixed in
Fixed in 2.0.0
CVSS
5.3 (medium)
Published
2025-11-18
Title
Amelia 1.2.18 - 1.2.36 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 1.2.37
CVSS
5.3 (medium)
Published
2025-11-15
Title
Booking for Appointments and Events Calendar – Amelia < 1.2.36 - Unauthenticated SQL Injection via search
Fixed in
Fixed in 1.2.36
CVSS
7.5 (high)
Published
2025-03-27
Title
Booking for Appointments and Events Calendar – Amelia < 1.2.20 - Unauthenticated Full Path Disclosure
Fixed in
Fixed in 1.2.20
CVSS
5.3 (medium)
Published
2025-02-23
Title
Amelia < 1.2.17 - Unauthenticated Insecure Direct Object Reference
Fixed in
Fixed in 1.2.17
CVSS
5.3 (medium)
Published
2024-09-04
Title
Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite < 1.2.5 - Missing Authorization to Sensitive Information Exposure
Fixed in
Fixed in 1.2.5
CVSS
5.3 (medium)
Published
2024-08-07
Title
Booking for Appointments and Events Calendar – Amelia < 1.2.1 - Unauthenticated Full Path Disclosure
Fixed in
Fixed in 1.2.1
CVSS
5.3 (medium)
Published
2024-06-20
Title
Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.6
CVSS
4.4 (medium)
Published
2024-04-10
Title
Amelia < 1.0.96 - Cross-Site Request Forgery
Fixed in
Fixed in 1.0.96
CVSS
4.3 (medium)
Published
2024-02-29
Title
Booking for Appointments and Events Calendar – Amelia < 1.0.99 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.0.99
CVSS
6.1 (medium)
Published
2024-01-18
Title
Booking for Appointments and Events Calendar – Amelia < 1.0.94 - Contributor+ Stored Cross-Site Scripting via shortcode
Fixed in
Fixed in 1.0.94
CVSS
6.4 (medium)
Published
2024-01-17
Title
Amelia < 1.0.99 - Missing Authorization
Fixed in
Fixed in 1.0.99
CVSS
6.5 (medium)
Published
2023-12-22
Title
Booking for Appointments and Events Calendar – Amelia < 1.0.86 - Contributor+ Stored XSS
Fixed in
Fixed in 1.0.86
CVSS
5.9 (medium)
Published
2023-04-06
Title
Appointment and Event Booking Calendar for WordPress < 1.0.76 - Reflected XSS
Fixed in
Fixed in 1.0.76
CVSS
7.1 (high)
Published
2022-03-14
Title
Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure
Fixed in
Fixed in 1.0.48
CVSS
4.3 (medium)
Published
2022-03-14
Title
Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
Fixed in
Fixed in 1.0.49
CVSS
5.4 (medium)
Published
2022-03-02
Title
Amelia < 1.0.47 - Unauthenticated Stored XSS via lastName
Fixed in
Fixed in 1.0.47
CVSS
7.2 (high)
Published
2022-03-01
Title
Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
Fixed in
Fixed in 1.0.47
CVSS
7.6 (high)
Published
2022-02-23
Title
Amelia < 1.0.46 - Manager+ RCE
Fixed in
Fixed in 1.0.46
CVSS
6.6 (medium)
Published
2022-02-23
Title
Amelia < 1.0.46 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.0.46
CVSS
6.1 (medium)
Published
2022-02-23
Title
Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF
Fixed in
Fixed in 1.0.46
CVSS
5.4 (medium)