CVE-2026-40795

The Amelia plugin for WordPress (versions up to 2.4.11) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This may allow manipulation of database queries.

The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.

The Amelia (Booking for Appointments and Events Calendar) plugin for WordPress in versions up to and including 2.4.12 is vulnerable to Sensitive Information Exposure via the 'page' parameter. Unauthenticated attackers can extract staff personally identifiable information (full name, email address, phone number, gender, timezone) and administrator-authored internal notes for every published event, because the raw providers array is never stripped before output in the JSON response.

The Amelia WordPress plugin (through version 2.4.12) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.

The Amelia WordPress plugin (through version 2.4.10) has missing authorization, allowing exploitation of incorrectly configured access control security levels. An attacker could perform operations they should not be permitted to.

Missing Authorization vulnerability in TMS Amelia ameliabooking allows exploiting incorrectly configured access control security levels. This issue affects Amelia from n/a through 2.4.10.

A Missing Authorization vulnerability in the Amelia plugin for WordPress, affecting versions up to 2.4.10, allows exploitation of incorrectly configured access control security levels.

The Amelia plugin in versions up to and including 2.4.9 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.

The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.

The Amelia plugin for WordPress is vulnerable to SQL Injection during customer import. This affects all versions up to and including 2.4.3 due to insufficient input escaping and lack of query preparation.