EUVD-2026-76874
GHSA-h5pf-gc8w-pff5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate as WordPress Contributor with Elementor access
-
DeliveryOpen Elementor editor on a target page
-
ExploitInsert Amelia booking widget with malicious load_manually payload
-
InstallPublish page
-
C2Victim browses to injected page
-
ExecuteStored XSS executes in victim browser
-
ImpactHarvest session tokens or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concurrent conditions: (1) the target WordPress site must have both the Amelia Booking plugin at version 2.4.9 or earlier and the Elementor page-builder installed and active; (2) the attacker must hold at minimum a Contributor-level WordPress account with permission to create or edit pages in Elementor; and (3) the attacker-modified page must be published and subsequently visited by a victim. The CVSS PR:L confirms authentication at low privilege is required - there is no unauthenticated remote exploitation path. Deployments that restrict Elementor page-creation access exclusively to Editor or Administrator roles are not practically exploitable even on the unpatched plugin version. |
| Impact | The CVSS 6.4 score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) correctly reflects the scope-changed nature of stored XSS - the attacker operates at Contributor level, but impact cascades to all page visitors' browser sessions. No CISA KEV listing and no public proof-of-concept have been identified, keeping opportunistic exploitation probability qualitatively low; however, even a mid-sized municipal IT team in gdynia operating a public appointment system with semi-trusted Contributor-level editors should treat this as a realistic threat given the low access barrier once that role is obtained. The partial patch in 2.4.8 and a second round of fixes in changeset 3687762 indicate the vulnerability spans multiple widget classes, broadening the attack surface beyond a single-widget flaw. EPSS data is not present in the provided input, so quantified exploitation probability is unavailable. |
| Exploit ScenarioDerived | An attacker with Contributor-level WordPress access creates or edits a page using Elementor, inserts an Amelia booking widget, and supplies a crafted JavaScript payload in the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized load_manually parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.
RemediationAI
Update the Amelia Booking plugin to the version that incorporates WordPress changeset 3687762, which represents the more complete remediation beyond the partial fix shipped in 2.4.8. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/06ec5c60-169c-4bbb-92bf-802805d46c62 and the WordPress plugin changelog to identify the exact tagged release containing changeset 3687762. As a compensating control while patching is pending, revoke Elementor editor access from Contributor-level accounts to prevent untrusted users from configuring Amelia Elementor widgets - this eliminates the attack path at the cost of Contributor-level page-building capability. Administrators should also audit existing Elementor pages containing Amelia booking widgets for signs of pre-existing injected payloads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Amelia Booking plugin (CPE: cpe:2.3:a:melograno:booking_for_appointments_and_events_calendar_-_amelia) integrates with the Elementor page-builder and exposes at least four custom widget classes: AmeliaStepBookingElementorWidget, AmeliaEventsElementorWidget, AmeliaEventsCalendarBookingElementorWidget, and AmeliaEventsListBookingElementorWidget. Each class passes the load_manually parameter directly into its render() output without sanitization or escaping, constituting CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). The WordPress plugin repository source code at the referenced trac.wordpress.org URLs documents the vulnerable lines (L226, L200, L134, L186, L247) where unsanitized output occurs. Because the payload is stored server-side inside Elementor widget configuration, it executes for all page visitors without requiring any further attacker interaction after initial injection.
Know when Booking For Appointments And Events Calendar Amelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level authentication required (PR:L); stored payload fires for all page visitors without further attacker action, producing scope change (S:C) to victim browsers; no server-side availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Prem
Authenticated privilege escalation to Administrator in Amelia WordPress plugin (all versions ≤2.1.3) allows Provider-lev
The Amelia Booking plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious
Unauthenticated information disclosure in the Amelia booking plugin for WordPress (all versions through 2.4.12) lets rem
Unauthenticated attackers can approve any WordPress booking in 'waiting' status via the admin-ajax endpoint in Amelia pl
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding
Exploit-DB