Booking For Appointments And Events Calendar
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:booking_for_appointments_and_events_calendar:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Booking For Appointments And Events Calendar (87930e9d-3835-5c3c-9b37-81ed0a0d7ed1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14211 |
vulnerable | 2026-09-16 04:33:12.410306 |
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
Published: 2026-08-10T06:00:18.388Z
Updated: 2026-08-11T20:56:01.616Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14214 |
vulnerable | 2026-09-16 04:33:12.343615 |
Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
Published: 2026-08-01T06:00:13.063Z
Updated: 2026-08-05T16:18:39.678Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14213 |
vulnerable | 2026-09-16 04:33:11.512832 |
Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
Published: 2026-08-13T06:00:13.140Z
Updated: 2026-08-13T13:53:47.047Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-77689 |
vulnerable | 2026-09-16 04:32:40.522639 |
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Published: 2026-09-12T06:00:07.767Z
Updated: 2026-09-12T15:35:52.587Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-77705 |
vulnerable | 2026-09-16 04:32:40.493860 |
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
Published: 2026-09-12T06:00:07.938Z
Updated: 2026-09-12T15:35:37.592Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.