TMS Amelia CVE-2026-116396

Exploitation requires an authenticated low-privilege account on the target WordPress site (CVSS PR:L) plus victim interaction (UI:R) - a second user, typically a higher-privileged operator or administrator, must view the page where the attacker's payload was stored. The attack is limited by these two factors: the attacker cannot exploit it anonymously, and the payload only fires when a victim renders the affected content. The available sources do not name the exact Amelia input field, form, or configuration that accepts the stored payload, so the precise trigger is not described in the available sources. Applies to Amelia versions from n/a through 2.4.12.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) reported by Patchstack against the TMS Amelia WordPress booking plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation that requires an authenticated low-privilege account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. The low confidentiality, integrity, and availability impacts (all :L) are consistent with a stored XSS rather than direct server compromise. The vuln.today priority is 'this_month' - not act_now or emergency - which aligns with the absence of a CISA KEV listing and the lack of any provided EPSS score. No exploitation-probability (EPSS) data, KEV status, or SSVC automatable/technical-impact fields were supplied, so widespread or automated exploitation cannot be inferred; the realistic risk is targeted abuse by a user who already holds a foothold account. In short, this is a genuine but second-tier issue: credible (vendor-adjacent Patchstack report) yet gated behind authentication and user interaction, making it a 'patch on a normal cycle' item rather than an emergency.

A low-privileged authenticated user (for example a customer or staff account permitted to submit booking-related data) stores a malicious script payload in a field that Amelia renders without proper neutralization. When a higher-privileged user such as an administrator later views that data in the WordPress dashboard, the script executes in their session, potentially enabling session actions or UI manipulation. No public exploit identified at time of analysis; the exact injectable field and trigger are not described in the available sources.