Booking for Appointments and Events Calendar – Amelia vulnerabilities

Product

Booking for Appointments and Events Calendar – Amelia

by melograno · last CVE Sep 17, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 1Medium 4Low 0

Severity

Exploitation

Watch

Add Booking for Appointments and Events Calendar – Amelia to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-9055	9.8	1%	Sep 2	Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' Affected: 8.0 through 9.6.2
CVE-2026-6286	7.2	1%	Aug 28	Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission Affected: through 2.2
CVE-2026-10148	6.4	0%	Sep 12	Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter Affected: through 2.4.9
CVE-2026-14311	5.4	0%	Sep 17	Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover Affected: through 2.4.4
CVE-2026-16582	5.3	0%	Sep 17	Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass Affected: through 2.4.5
CVE-2026-14782	4.9	0%	Jul 16	Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import Affected: through 2.4.3