Melograno vulnerabilities
We track 4 vulnerabilities in Melograno products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest Melograno vulnerabilities
- 7.5 High severity
Booking for Appointments and Events Calendar –…: Missing Authorization
The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `a
- 8.8 High severity
The Innovative Form Builder – IvyForms: Unrestricted Upload of File with Dangerous Type
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a d
- 9.8 Critical severity
Booking for Appointments and Events Calendar –…: Improper Privilege Management
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update en
- 7.2 High severity
Booking for Appointments and Events Calendar –…: Improper Neutralization of Input During Web Page Generation
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explic