CVE-2026-10148

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsCalendarBookingElementorWidget.php#L186
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsElementorWidget.php#L134
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaEventsListBookingElementorWidget.php#L247
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L200
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.2.1/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L226
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsCalendarBookingElementorWidget.php#L186
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsElementorWidget.php#L134
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaEventsListBookingElementorWidget.php#L247
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L200
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/Elementor/AmeliaStepBookingElementorWidget.php#L226
• https://plugins.trac.wordpress.org/changeset/3657136/
• https://plugins.trac.wordpress.org/changeset/3687762/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/06ec5c60-169c-4bbb-92bf-802805d46c62?source=cve

Published

Sep 12, 2026

Last Modified

Sep 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1014IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …6.5
• CVE-2026-10140IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains im…9.6
• CVE-2026-10142kafka-python prior to 2.3.2 contains a denial-of-service vul…8.7
• CVE-2026-10143kafka-python prior to 2.3.2 contains a denial-of-service vul…7.5
• CVE-2026-10144Rsbuild before 2.0.9 contains a command injection vulnerabil…7.8
• CVE-2026-10145Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10149Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-1015IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …5.4
• CVE-2026-10150Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10152A vulnerability was detected in TaleLin lin-cms-spring-boot …6.3
• CVE-2026-10153A flaw has been found in westboy CicadasCMS up to 2431154dac…4.3
• CVE-2026-10154A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23…5.3