Melograno
Vulnerability activity for Melograno: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.5HighNov 7, 2026Melograno Booking for Appointments and Events Calendar – Amelia Auth bypass / access controlCVE-2026-107616The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This m
- 6.5MediumNov 7, 2026Melograno Booking for Appointments and Events Calendar – Amelia Auth bypass / access controlCVE-2026-104992The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of p
- 5.3MediumOct 31, 2026Melograno Booking for Appointments and Events Calendar – Amelia Information disclosureCVE-2026-103915The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because
- 8.8HighOct 28, 2026Melograno The Innovative Form Builder – IvyForms Path traversal / file handlingCVE-2026-109384The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers,Exploit code
- 5.3MediumSep 17, 2026Melograno Booking for Appointments and Events Calendar – Amelia Auth bypass / access controlCVE-2026-16582The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
- 5.4MediumSep 17, 2026Melograno Booking for Appointments and Events Calendar – Amelia Auth bypass / access controlCVE-2026-14311The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that u
- 6.4MediumSep 12, 2026Melograno Booking for Appointments and Events Calendar – Amelia XSSCVE-2026-10148The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whene
Top products
- Booking for Appointments and Events Calendar – Amelia6 CVEs in the last year
- The Innovative Form Builder – IvyForms1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.