Filtered by vendor Wordpress-extensions Subscriptions
Filtered by product Amelia Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-77705 1 Wordpress-extensions 1 Amelia 2026-11-13 7.2 High
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
CVE-2026-14216 1 Wordpress-extensions 1 Amelia 2026-11-11 6.5 Medium
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
CVE-2026-14215 1 Wordpress-extensions 1 Amelia 2026-11-11 6.5 Medium
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
CVE-2026-14214 1 Wordpress-extensions 1 Amelia 2026-11-11 2.7 Low
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.