What’s Vulnerable › Products

TMS Amelia vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your TMS Amelia version is affected

Latest TMS Amelia vulnerabilities

• CVE-2026-116396 — WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-116388 — WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-112327 — WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability (CVSS 9.3)
• CVE-2026-108497 — WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability (CVSS 9.3)
• CVE-2026-109684 — WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-96461 — WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-48889 — WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability (CVSS 8.8)
• CVE-2026-40795 — WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2026-40789 — WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability (CVSS 7.5)
• CVE-2024-6552 — Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure (CVSS 5.3)
• CVE-2024-6225 — Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2024-22298 — WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability (CVSS 9.8)
• CVE-2024-31425 — WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
• CVE-2023-6808 — Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 5.4)
• CVE-2023-50860 — WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
• CVE-2023-29427 — WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
• CVE-2023-27918 — (CVSS 6.1)
• CVE-2022-0837 — Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure (CVSS 5.4)
• CVE-2022-0825 — Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update (CVSS 5.4)
• CVE-2022-0720 — Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure (CVSS 5.4)
• CVE-2022-0687 — Amelia < 1.0.46 - Manager+ RCE (CVSS 8.8)
• CVE-2022-0627 — Amelia < 1.0.46 - Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2022-0616 — Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF (CVSS 4.3)