CVE-2026-16582: medium-severity vulnerability in melograno Booking for Appointments and Events…
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
melograno · Booking for Appointments and Events Calendar – AmeliaRelated CVEs — melograno Booking for Appointments and Events…
In the same product, most dangerous first.
CVE-2026-6286HIGHBooking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking SubmissionEPSS 0.6%CVE-2026-9055CRITICALBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'EPSS 0.5%CVE-2026-10148MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' ParameterEPSS 0.4%CVE-2026-14782MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer ImportEPSS 0.4%CVE-2026-103915MEDIUMBooking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' ParameterEPSS 0.3%CVE-2026-14311MEDIUMBooking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account TakeoverEPSS 0.2%