CVE-2026-116396 in Amelia Plugin
Summary
by MITRE • 10/26/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the TMS Amelia booking plugin for WordPress. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted URL, stored vulnerabilities persist on the target server. In this context, an attacker can inject malicious JavaScript code into input fields that are subsequently saved to the database without proper sanitization or encoding. When other users or administrators later view pages containing this data, the browser executes the embedded script in their session context. This affects versions of Amelia from n/a through 2.4.12, indicating a long-standing exposure for organizations relying on these older iterations of the software.
The technical root cause lies in the application's failure to properly validate and encode user-supplied input before rendering it within HTML responses. By allowing arbitrary script execution, the vulnerability bypasses standard browser security mechanisms such as the Same-Origin Policy. This allows an attacker to perform actions on behalf of authenticated users, steal session cookies or authentication tokens, redirect victims to malicious sites, or deface web pages. The persistence of this data means that every user who accesses the compromised page is potentially exposed, amplifying the impact significantly compared to one-time exploitation vectors.
From a threat intelligence perspective, this vulnerability aligns with CWE-79, which categorizes improper neutralization of input during web page generation. In terms of offensive security frameworks like MITRE ATT&CK, this flaw facilitates techniques associated with Collection and Credential Access, specifically under the T1056 category for Input Capture or T1204 for User Execution if social engineering is employed to trigger the payload. The ability to execute scripts in a privileged context can also lead to privilege escalation if administrative functions are accessible via client-side code manipulation.
The operational impact of this vulnerability extends beyond simple defacement. Attackers can use stored XSS as an initial access vector to deploy web shells, exfiltrate sensitive customer data such as names and contact information from booking records, or hijack administrator accounts by stealing session cookies. This compromises the confidentiality, integrity, and availability of the application's data. For businesses using Amelia for appointment scheduling, this represents a significant risk to customer trust and regulatory compliance regarding personal data protection.
Mitigation strategies should prioritize immediate patching to version 2.4.13 or later where these input validation issues have been addressed by the developers. In environments where upgrading is not immediately feasible, administrators can implement Web Application Firewall rules to detect and block common XSS payloads in HTTP requests targeting Amelia endpoints. Additionally, enforcing Content Security Policy headers that restrict script execution sources can mitigate the impact of any successfully injected scripts. Regular security audits and code reviews focusing on input handling are essential for maintaining long-term resilience against such injection-based attacks.