melograno vulnerabilities and threats

The Innovative Form Builder – IvyForms WordPress plugin (versions up to 1.5.1) contains an arbitrary file upload vulnerability due to insufficient file type validation. Authenticated users with custom-level access can configure file upload fields to allow dangerous file extensions like PHP. This enables unauthenticated visitors to upload potentially executable files via a public REST API endpoint, leading to possible remote code execution.

The Booking for Appointments and Events Calendar – Amelia WordPress plugin (Premium version) up to and including version 2.4.4 contains a missing authorization vulnerability. Authenticated users with the wpamelia-provider role can access and modify arbitrary customer data via the /users/customers/<id> endpoint without proper ownership verification. This includes the ability to reset customer passwords and potentially take over WordPress user accounts with roles up to Editor if those users had made an Amelia booking.

The Booking for Appointments and Events Calendar – Amelia WordPress plugin contains a missing authorization vulnerability in all versions up to and including 2.4.5. This flaw allows unauthenticated attackers to create approved appointment bookings without completing payment by exploiting the plugin's acceptance of a client-supplied package-redemption identifier without validation.

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.

Editor SQL Injection in Amelia <= 2.4.9 versions.

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw in versions up to and including 2.2. This vulnerability arises from an authentication bypass that allows unauthenticated users to submit booking data with malicious payloads in customer name fields. The plugin sanitizes input by removing HTML tags but preserves special characters like double quotes, which are then improperly embedded into JavaScript template literals and rendered via innerHTML without proper encoding. As a result, attackers can inject scripts that execute when an administrator views the Calendar page and interacts with the malicious booking entry.

CVE-2026-66597 is a high-severity vulnerability in the wpDataTables plugin by Melograno Venture Studio. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks in versions up to 6.5.1.4. This vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. Exploitation requires user interaction but no privileges or authentication. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is affected by an SQL Injection vulnerability in versions up to and including 2.4.3. This vulnerability arises from insufficient escaping of user-supplied input in the Customer Import feature, allowing authenticated users with the wpamelia-manager role to inject additional SQL queries. The vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS score is 4.9, indicating a medium severity. No official patch or remediation has been confirmed yet.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.4.2.

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.