WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

ameliabooking · Cross-site scripting · CWE-79

Affectedameliabooking

FixUpdate to 2.4.13 or newer

PublishedOct 26, 16:39 · Patchstack

ScoredOct 26 · 6.5 · Patchstack

Exploit code publicNone known · checked 22:18 UTC

ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inameliabookingearlier versions2.4.13

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-4-12-cross-site-scripting-xss-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in ameliabooking

All 12 →

5.3WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability · CVE-2026-116388Oct 26 9.3WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability · CVE-2026-112327Oct 22 9.3WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability · CVE-2026-108497Oct 15