TMS vulnerabilities

Products

• Amelia 11
• wpDataTables 3
• Booking for Appointments and Events Calendar – Amelia 2
• Appointment and Event Booking Calendar for WordPress - Amelia 1
• IvyForms 1

Latest TMS CVEs

Newest publication first

1. CVE-2026-123148 WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.23%

   Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

2. CVE-2026-116388 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

   Published 2026-10-26

   Medium·CVSS 5.3 EPSS 0.23%

   Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

3. CVE-2026-116396 WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-26

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.

4. CVE-2026-112327 WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability

   Published 2026-10-22

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.

5. CVE-2026-108497 WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

   Published 2026-10-15

   Critical·CVSS 9.3 EPSS 0.23%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.

6. CVE-2026-109684 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

   Published 2026-10-13

   Medium·CVSS 5.3 EPSS 0.18%

   Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

7. CVE-2026-96461 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

   Published 2026-10-09

   High·CVSS 7.5 EPSS 0.20%

   Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

8. CVE-2026-54825 WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability

   Published 2026-06-26

   Critical·CVSS 9.3 EPSS 0.40%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows Blind SQL Injection.This issue affects wpDataTables: from n/a through 7.4.

9. CVE-2026-49080 WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability

   Published 2026-06-16

   Critical·CVSS 9.3 EPSS 0.31%

   Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

10. CVE-2026-48889 WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability

    Published 2026-06-15

    High·CVSS 8.8 EPSS 0.41%

    Subscriber Privilege Escalation in Amelia <= 2.3 versions.

11. CVE-2026-40795 WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability

    Published 2026-06-15

    Medium·CVSS 6.5 EPSS 0.27%

    Subscriber Broken Access Control in Amelia <= 2.2 versions.

12. CVE-2026-40789 WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability

    Published 2026-06-15

    High·CVSS 7.5 EPSS 0.29%

    Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

13. CVE-2026-28039 WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability

    Published 2026-03-05

    High·CVSS 7.5 EPSS 0.42%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1.

14. CVE-2024-22298 WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability

    Published 2024-06-10

    Critical·CVSS 9.8 EPSS 0.38%

    Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98.

15. CVE-2024-31425 WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2024-04-15

    Medium·CVSS 5.4 EPSS 0.20%

    Cross-Site Request Forgery (CSRF) vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95.

16. CVE-2023-50860 WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)

    Published 2023-12-28

    Medium·CVSS 5.4 EPSS 0.33%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85.

17. CVE-2023-29427 WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)

    Published 2023-06-26

    Medium·CVSS 6.1 EPSS 0.41%

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia plugin <= 1.0.75 versions.

18. CVE-2023-27918 Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by h...

    Published 2023-05-10

    Medium·CVSS 6.1 EPSS 0.51%

    Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.