Ameliabooking vulnerabilities
We track 5 vulnerabilities in Ameliabooking products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 8, 2026.
Latest Ameliabooking vulnerabilities
- 7.6 High severity
Amelia: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.1.1.
- 8.8 High severity
Booking for Appointments and Events Calendar –…: Authorization Bypass Through User-Controlled Key
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the `
- 8.8 High severity
Booking for Appointments and Events Calendar –…: Improper Privilege Management
The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system res
- 7.2 High severity
Amelia: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in ameliabooking Amelia ameliabooking allows Privilege Escalation.This issue affects Amelia: from n/a through <= 1.2.38.
- 7.5 High severity
Booking for Appointments and Events Calendar –…: Improper Neutralization of Special Elements used in an SQL Command
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of suffic