Threat database

CVE-2026-108497 is a critical SQL Injection vulnerability in TMS Amelia (ameliabooking) affecting versions from initial releases up to 2.4.10. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling an attacker to execute unauthorized SQL queries. This vulnerability has a high CVSS score of 9.3, indicating critical impact on confidentiality and some impact on availability. No official patch or remediation information is provided in the data. No known exploits are reported in the wild.

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

CVE-2026-96461 is a missing authorization vulnerability in the TMS Amelia booking plugin affecting versions prior to 2.4.11. It allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits are reported in the wild. The affected versions range from initial releases up to 2.4.10.

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

Subscriber Privilege Escalation in Amelia <= 2.3 versions.

Subscriber Broken Access Control in Amelia <= 2.2 versions.

Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fshow' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98.

Cross-Site Request Forgery (CSRF) vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95.