WordPress plugin · ameliabooking
Is Booking for Appointments and Events Calendar safe?
4 flaws affect the current version.
The newest release on wordpress.org, 2.4.14, is inside the affected range of 4 records, so there may be no fix yet. Check the changelog; if it doesn’t mention the fix, deactivate it until it does.
- Flaws on record
- 53
- High or critical
- 17
- Exploited
- none
- Current version
- 2.4.14
- Last updated
- Oct 27, 2026
- Active installs
- 90,000+
Every recorded flaw
- Oct 26, 2026Amelia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116396 · affects up to 2.4.12 · reported by PatchstackMedium 6.5
- Oct 26, 2026Amelia: Missing AuthorizationCVE-2026-116388 · affects up to 2.4.10 · reported by PatchstackMedium 5.3
- Oct 22, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112327 · affects up to 2.4.11 · reported by PatchstackCritical 9.3
- Oct 15, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-108497 · affects up to 2.4.10 · reported by PatchstackCritical 9.3
- Oct 13, 2026Amelia: Missing AuthorizationCVE-2026-109684 · affects up to 2.4.10 · reported by PatchstackMedium 5.3
- Oct 9, 2026Amelia: Missing AuthorizationCVE-2026-96461 · affects up to 2.4.10 · reported by PatchstackHigh 7.5
- Sep 17, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized modification of dataCVE-2026-16582 · affects up to 2.4.5 · reported by WordfenceMedium 5.3
- Sep 17, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized access and modification of dataCVE-2026-14311 · affects up to 2.4.4 · reported by WordfenceMedium 5.4
- Sep 12, 2026Booking for Appointments and Events Calendar: Stored Cross-Site ScriptingCVE-2026-10148 · affects up to 2.4.9 · reported by WordfenceMedium 6.4
- Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · fixed in 2.4.10 · reported by WPScanHigh 7.2
- Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · fixed in 9.8.1 · reported by WPScanMedium 5.3
- Sep 11, 2026Editor SQL Injection in Amelia <= 2.4.9 versions.CVE-2026-62112 · affects up to 2.4.9 · reported by PatchstackHigh 7.6
- Sep 2, 2026Booking for Appointments and Events Calendar: Does not require authentication or a valid request token before running the post-booking action chainCVE-2026-14215 · fixed in 2.4.9 · reported by WPScanMedium 6.5
- Aug 29, 2026Booking for Appointments and Events Calendar: Does not check that a user holds the required capability before letting them change an appointment's statusCVE-2026-77704 · fixed in 2.4.9 · reported by WPScanLow 2.7
- Aug 28, 2026Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2026-6286 · affects up to 2.2 · reported by WordfenceHigh 7.2
- Aug 26, 2026Booking for Appointments and Events Calendar: Does not require authentication before processing its pending notification queueCVE-2026-14216 · fixed in 2.4.7 · reported by WPScanMedium 6.5
- Aug 26, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) owns the provider account being updatedCVE-2026-14212 · fixed in 9.8 · reported by WPScanMedium 4.7
- Aug 13, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is assigned to the appointment being accessedCVE-2026-14213 · fixed in 2.4.6 · reported by WPScanLow 3.7
- Aug 10, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is related to the customer whose record is being accessedCVE-2026-14211 · fixed in 9.7 · reported by WPScanLow 3.8
- Aug 1, 2026Booking for Appointments and Events Calendar: Does not restrictCVE-2026-14214 · fixed in 2.4.4 · reported by WPScanLow 2.7
- Jul 16, 2026Booking for Appointments and Events Calendar – Amelia: SQL InjectionCVE-2026-14782 · affects up to 2.4.3 · reported by WordfenceMedium 4.9
- Jul 13, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57702 · affects up to 2.4.2 · reported by PatchstackCritical 9.3
- Jun 15, 2026Subscriber Privilege Escalation in Amelia <= 2.3 versions.CVE-2026-48889 · affects up to 2.3 · reported by PatchstackHigh 8.8
- Jun 15, 2026Subscriber Broken Access Control in Amelia <= 2.2 versions.CVE-2026-40795 · affects up to 2.2 · reported by PatchstackMedium 6.5
- Jun 15, 2026Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.CVE-2026-40789 · affects up to 2.2 · reported by PatchstackHigh 7.5
- May 2, 2026Booking for Appointments and Events Calendar – Amelia: Improper AuthorizationCVE-2026-6449 · affects up to 2.1.2 · reported by WordfenceMedium 5.3
- Apr 8, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39487 · affects up to 2.1.1 · reported by PatchstackHigh 7.6
- Apr 7, 2026Booking for Appointments and Events Calendar – Amelia: Insecure Direct Object ReferenceCVE-2026-5465 · affects up to 2.1.3 · reported by WordfenceHigh 8.8
- Mar 31, 2026Booking for Appointments and Events Calendar - Amelia: SQL InjectionCVE-2026-4668 · affects up to 2.1.2 · reported by WordfenceMedium 6.5
- Mar 26, 2026Amelia Booking: Insecure Direct Object ReferencesCVE-2026-2931 · affects up to 9.1.2 · reported by WordfenceHigh 8.8
- Mar 5, 2026Amelia: Incorrect Privilege AssignmentCVE-2026-24963 · affects up to 1.2.38 · reported by PatchstackHigh 7.2
- Feb 3, 2026Amelia: Missing AuthorizationCVE-2026-24967 · affects up to 1.2.38 · reported by PatchstackMedium 5.3
- Jan 9, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized accessCVE-2025-14720 · affects up to 1.2.38 · reported by WordfenceMedium 5.3
- Nov 16, 2025Booking for Appointments and Events Calendar – Amelia: SQL InjectionCVE-2025-12482 · affects up to 1.2.35 · reported by WordfenceHigh 7.5
- Mar 28, 2025Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2025-2578 · affects up to 1.2.19 · reported by WordfenceMedium 5.3
- Feb 25, 2025Amelia: Authorization Bypass Through User-Controlled KeyCVE-2025-26965 · affects up to 1.2.16 · reported by PatchstackMedium 5.3
- Sep 5, 2024The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing CVE-2024-6332 · affects up to Premium · reported by WordfenceMedium 6.5
- Aug 8, 2024Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2024-6552 · affects up to 1.2 · reported by WordfenceMedium 5.3
- Jun 21, 2024Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2024-6225 · affects up to 1.1.5 · reported by WordfenceMedium 4.4
- Jun 10, 2024Amelia: Missing AuthorizationCVE-2024-22298 · affects up to 1.0.98 · reported by PatchstackMedium 5.3
- Apr 15, 2024Amelia: Cross-Site Request Forgery (CSRF)CVE-2024-31425 · affects up to 1.0.95 · reported by PatchstackMedium 5.4
- Mar 13, 2024Booking for Appointments and Events Calendar – Amelia: Reflected Cross-Site ScriptingCVE-2024-1484 · affects up to 1.0.98 · reported by WordfenceMedium 6.1
- Feb 5, 2024Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2023-6808 · affects up to 1.0.93 · reported by WordfenceMedium 6.4
- Dec 28, 2023Booking for Appointments and Events Calendar – Amelia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50860 · affects up to 1.0.85 · reported by PatchstackMedium 6.5
- Jun 26, 2023Unauth.CVE-2023-29427 · affects up to 1.0.75 · reported by PatchstackHigh 7.1
- May 10, 2023Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76: Cross-site scriptingCVE-2023-27918 · fixed in 1.0.76 · reported by vultures@jpcert.or.jpMedium 6.1
- Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0837 · fixed in 1.0.48 · reported by WPScanMedium 5.4
- Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0825 · fixed in 1.0.49 · reported by WPScanMedium 5.4
- Mar 28, 2022Amelia: Does not have proper authorisationCVE-2022-0720 · fixed in 1.0.47 · reported by WPScanMedium 5.4
- Mar 23, 2022Amelia: Cross-Site ScriptingCVE-2022-0834 · affects up to 1.0.46 · reported by WordfenceHigh 7.2
- Mar 21, 2022Amelia: Stores image blobs into actual files whose extension is controlled by the userCVE-2022-0687 · fixed in 1.0.47 · reported by WPScan1.5% oddsHigh 8.8
- Mar 21, 2022Amelia: Does not sanitize and escape the code parameter before outputting it back in an admin pageCVE-2022-0627 · fixed in 1.0.47 · reported by WPScanMedium 6.1
- Mar 21, 2022Amelia: Does not have CSRF check in placeCVE-2022-0616 · fixed in 1.0.47 · reported by WPScanMedium 4.3
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.