Melograno
Monthly
Arbitrary file upload in the WordPress plugin The Innovative Form Builder - IvyForms, affecting all versions up to and including 1.5.1, allows a user holding the custom add_edit_forms capability to publish a File Upload field whose allowed-extension list contains a dangerous type such as .php, after which an unauthenticated visitor can push an executable file through the public /wp-json/ivyforms/v1/form/submission/ REST route and achieve remote code execution. Exploitation is therefore two-stage: the first stage requires an account with form-editing rights and a deliberately permissive form configuration, while the second stage - the actual upload - needs no authentication and no user interaction from the victim. The 8.8 CVSS score reflects post-configuration impact rather than immediate exposure, since a site whose forms only allow benign extensions is not exploitable; no public exploit code was identified at the time of analysis and the plugin is not listed in CISA KEV, with priority assessed as this_week.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Unauthenticated information disclosure in the Amelia booking plugin for WordPress (all versions through 2.4.12) lets remote attackers harvest staff personally identifiable information - full name, email address, phone number, gender and timezone - along with administrator-authored internal notes for every published event, by supplying a crafted 'page' parameter that causes the raw providers array to be serialized into the JSON response. With a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only at C:L), the issue is a genuine but moderate-priority data leakage exposure rather than an emergency, and the available intelligence indicates no public exploit code and no confirmed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized `load_manually` parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding the wpamelia-manager role to exfiltrate arbitrary data from the site's database via the Customer Import feature. The flaw stems from unsanitized user-supplied parameters passed into pre-existing SQL queries without adequate escaping or prepared statement usage, enabling stacked or appended query manipulation. No public exploit code or active exploitation has been identified at the time of analysis, and the confidentiality-only impact (C:H/I:N/A:N) reflects read-level database access rather than modification or destruction capability.
Arbitrary file upload in the WordPress plugin The Innovative Form Builder - IvyForms, affecting all versions up to and including 1.5.1, allows a user holding the custom add_edit_forms capability to publish a File Upload field whose allowed-extension list contains a dangerous type such as .php, after which an unauthenticated visitor can push an executable file through the public /wp-json/ivyforms/v1/form/submission/ REST route and achieve remote code execution. Exploitation is therefore two-stage: the first stage requires an account with form-editing rights and a deliberately permissive form configuration, while the second stage - the actual upload - needs no authentication and no user interaction from the victim. The 8.8 CVSS score reflects post-configuration impact rather than immediate exposure, since a site whose forms only allow benign extensions is not exploitable; no public exploit code was identified at the time of analysis and the plugin is not listed in CISA KEV, with priority assessed as this_week.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Unauthenticated information disclosure in the Amelia booking plugin for WordPress (all versions through 2.4.12) lets remote attackers harvest staff personally identifiable information - full name, email address, phone number, gender and timezone - along with administrator-authored internal notes for every published event, by supplying a crafted 'page' parameter that causes the raw providers array to be serialized into the JSON response. With a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only at C:L), the issue is a genuine but moderate-priority data leakage exposure rather than an emergency, and the available intelligence indicates no public exploit code and no confirmed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized `load_manually` parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding the wpamelia-manager role to exfiltrate arbitrary data from the site's database via the Customer Import feature. The flaw stems from unsanitized user-supplied parameters passed into pre-existing SQL queries without adequate escaping or prepared statement usage, enabling stacked or appended query manipulation. No public exploit code or active exploitation has been identified at the time of analysis, and the confidentiality-only impact (C:H/I:N/A:N) reflects read-level database access rather than modification or destruction capability.