CVE-2026-48889

The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.

The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.

The Amelia plugin for WordPress is vulnerable to SQL Injection during customer import. This affects all versions up to and including 2.4.3 due to insufficient input escaping and lack of query preparation.

Amelia versions up to 2.2 contain a broken access control vulnerability that may allow unauthorized users to access subscriber resources.

Amelia versions up to 2.2 have a vulnerability that allows unauthorized access to sensitive data.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection. This issue affects Amelia: from n/a through <= 2.1.1.