The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ameliabooking Plugin | — | Update ameliabooking plugin to version 1.0.47, or a newer patched version | May 15, 2025 | Mar 2, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub