CVE-2026-10148: fallo de gravedad media en melograno Booking for Appointments and Events…
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.4%
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
melograno · Booking for Appointments and Events Calendar – AmeliaCVEs relacionadas — melograno Booking for Appointments and Events…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-6286HIGHBooking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking SubmissionEPSS 0.6%CVE-2026-9055CRITICALBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'EPSS 0.5%CVE-2026-14782MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer ImportEPSS 0.4%CVE-2026-16582MEDIUMBooking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment BypassEPSS 0.3%CVE-2026-103915MEDIUMBooking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' ParameterEPSS 0.3%CVE-2026-14311MEDIUMBooking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account TakeoverEPSS 0.2%
Referencias
https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsCalendarBookingElementorWidget.php#L186https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsElementorWidget.php#L134https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsListBookingElementorWidget.php#L247https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L200https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L226https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsCalendarBookingElementorWidget.php#L186https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsElementorWidget.php#L134https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsListBookingElementorWidget.php#L247https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L200https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L226https://plugins.trac.wordpress.org/changeset/3657136/https://plugins.trac.wordpress.org/changeset/3687762/