WordPress amelia has 7 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-0687 | The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to | high | 8.8 | <1.0.47 | 1.0.47 |
| CVE-2022-0627 | The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leadin | medium | 6.1 | <1.0.47 | 1.0.47 |
| CVE-2022-0825 | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | <1.0.49 | 1.0.49 |
| CVE-2022-0720 | The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | <1.0.47 | 1.0.47 |
| CVE-2022-0837 | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send | medium | 5.4 | <1.0.48 | 1.0.48 |
| CVE-2022-0834 | The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter fo | high | 7.2 | <=1.0.46 | – |
| CVE-2022-0616 | The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a l | medium | 4.3 | <1.0.47 | 1.0.47 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked