CVE-2026-6286
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.
Risk Assessment
An unauthenticated attacker can inject scripts that execute in the administrator's browser, potentially leading to session theft or other attacks.
Recommendation
Update the Amelia plugin to a patched version and restrict access to the admin panel.
Other vulnerabilities in Amelia
See all- CVE-2026-112327Critical
The Amelia plugin for WordPress (versions up to 2.4.11) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This may allow manipulation of database queries.
- CVE-2026-57702Critical
The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.
- CVE-2026-103915Medium
The Amelia (Booking for Appointments and Events Calendar) plugin for WordPress in versions up to and including 2.4.12 is vulnerable to Sensitive Information Exposure via the 'page' parameter. Unauthenticated attackers can extract staff personally identifiable information (full name, email address, phone number, gender, timezone) and administrator-authored internal notes for every published event, because the raw providers array is never stripped before output in the JSON response.
- CVE-2026-116396Medium
The Amelia WordPress plugin (through version 2.4.12) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.
- CVE-2026-116388Medium
The Amelia WordPress plugin (through version 2.4.10) has missing authorization, allowing exploitation of incorrectly configured access control security levels. An attacker could perform operations they should not be permitted to.
- CVE-2026-109684Medium
Missing Authorization vulnerability in TMS Amelia ameliabooking allows exploiting incorrectly configured access control security levels. This issue affects Amelia from n/a through 2.4.10.
- CVE-2026-96461High
A Missing Authorization vulnerability in the Amelia plugin for WordPress, affecting versions up to 2.4.10, allows exploitation of incorrectly configured access control security levels.
- CVE-2026-62112High
The Amelia plugin in versions up to and including 2.4.9 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.
- CVE-2026-14782Medium
The Amelia plugin for WordPress is vulnerable to SQL Injection during customer import. This affects all versions up to and including 2.4.3 due to insufficient input escaping and lack of query preparation.
- CVE-2026-48889High
Amelia versions up to 2.3 contain a vulnerability that allows subscriber privilege escalation.
Original NVD description (English source)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitize_text_field() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a FullCalendar eventContent callback interpolates customer names directly into JavaScript template literals (redesign/dist/index.js line 199) and renders them via innerHTML without proper HTML entity encoding. Because double quotes are preserved, an attacker can inject payloads like '" onmouseover="alert(document.cookie)"' to break out of the title attribute and inject malicious event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator accesses the Calendar page and hovers over the malicious appointment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS