Amelia

Booking for Appointments and Events Calendar through 2.4.9 fails to sanitize and escape the load_manually parameter in the render() methods of multiple Elementor widgets. A contributor who can use Elementor can store JavaScript in a page and execute it for anyone who visits. Version 2.4.8 only partially patched the issue.

Amelia through 2.4.9 permits SQL injection by an authenticated Editor. The CNA vector requires no user interaction, rates confidentiality impact as high and availability impact as low, and does not claim database modification. The authoritative export does not identify the endpoint, action, parameter, query-building function, or SQL context.

Amelia before 2.4.9 does not require authentication or a valid request token before running its post-booking action chain. An unauthenticated visitor who enumerates a booking ID can trigger its notification and integration callbacks.

Amelia Pro 8.0 through 9.6.2 insufficiently validates the type value in its customer-update endpoint. An unauthenticated attacker can set type to manager with externalId set to 0, create a WordPress wpamelia-manager account, then create a provider linked to an Administrator user ID and overwrite that Administrator's password.

Amelia through 2.2 skips nonce verification in AddBookingCommand and accepts unauthenticated customer firstName and lastName values. Quotes survive sanitize_text_field(), are interpolated into FullCalendar event HTML, and can inject an event handler that executes when an administrator opens the Calendar and interacts with the malicious appointment.

Amelia before 2.4.6 lets an authenticated plugin employee or provider request an appointment by attacker-controlled numeric ID through its GET /appointments/{id} application route, carried through wp-admin/admin-ajax.php?action=wpamelia_api. GetAppointmentCommandHandler::handle() loads the record without confirming that the current provider is the appointment's assigned provider, so one provider can read another employee's appointment and booked-customer data. Version 2.4.6 rejects provider access unless the authenticated provider ID matches the appointment provider. Public sources do not map the plugin employee role to a stock WordPress role or disclose how a target ID is learned or the complete configuration-dependent PII fields.

Amelia 9.0 through 9.6 accepts sequential customer identifiers in its employee or provider panel without verifying that the customer is related to the logged-in employee. An Employee can enumerate identifiers and read or modify any customer's personal information.

Booking for Appointments and Events Calendar – Amelia is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.4.3.

Amelia is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.4.2.

Amelia is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 2.3.

Amelia is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.2.

Amelia is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is n/a through 2.2.

Booking for Appointments and Events Calendar – Amelia is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.1.2.

Amelia is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.1.1.

Booking for Appointments and Events Calendar – Amelia is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 2.1.3.

Booking for Appointments and Events Calendar – Amelia is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.1.2.

Booking for Appointments and Events Calendar – Amelia is affected by broken access control. Exploitation requires an authenticated customer account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 9.1.2.

Amelia is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

Amelia is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Booking for Appointments and Events Calendar – Amelia is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Amelia is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ameliabooking is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Booking for Appointments and Events Calendar – Amelia is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Amelia is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Amelia is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Booking for Appointments and Events Calendar – Amelia is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ameliabooking is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ameliabooking is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.