We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Booking for Appointments and Events Calendar – Amelia Plugin Vulnerability (CVE-2026-10148)

Nick Paliughi
On this page

Security Alert Summary

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress (Amelia) contains a stored cross-site scripting (XSS) vulnerability in multiple Elementor widgets. Insufficient input sanitization and output escaping of the load_manually parameter in widget render() methods can allow authenticated users with Contributor-level access or higher who can use Elementor to inject JavaScript that executes when an injected page is viewed.

CVE Details

  • CVE ID: CVE-2026-10148
  • Affected component: Booking for Appointments and Events Calendar – Amelia plugin for WordPress (Elementor widgets)
  • Affected versions: Versions up to and including 2.4.9
  • Published: September 12, 2026 at 1:16:50 PM UTC
  • Last modified: September 12, 2026 at 1:16:50 PM UTC
  • CVSS v3.1: Base Score 6.4 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: Requires low privileges (authenticated user with Contributor-level access or higher able to use Elementor); no user interaction required per CVSS data
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)

Technical Details

This is a stored XSS vulnerability resulting from insufficient input sanitization and output escaping of the load_manually parameter in the render() methods of multiple Elementor widget classes included with the plugin. An authenticated user who can edit content via Elementor and has Contributor-level access or higher can supply malicious HTML or script in that parameter. Because the data is stored and later rendered without proper escaping, the injected script will execute in the browser of any user who views the affected page.

The issue exists in the widget rendering code paths where the load_manually parameter is processed and echoed without adequate sanitization or escaping. The vulnerability was partially patched in version 2.4.8, but versions up to and including 2.4.9 are reported as affected.

How This Could Impact Your Website

Consider a site with a site owner, internal staff editors, and external contributors or contractors who use Elementor to build pages. A contributor who has access to Elementor could inject a script into an event or booking widget using the vulnerable parameter. When other users or staff view the page, the script could run in their browsers, potentially exposing session-related data visible to the client, capturing user interactions, or performing actions that rely on the viewers browser context.

Practical consequences include disclosure of internal user email addresses displayed on pages or accessible via client-side code, and an increased risk of targeted phishing or social engineering against staff or customers who view the compromised pages. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles and capabilities, especially for users who can use Elementor (limit to trusted editors and administrators).
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins and themes.
  • Monitor site activity and logs for unusual behavior, unexpected page edits, or content changes.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO (CVE-2026-85198)