Technical impact
The vulnerability is a stored cross‑site scripting flaw that enables an attacker to inject malicious JavaScript into Amelia’s database and trigger it when affected pages are viewed. The impact is the potential to hijack sessions, deface content, steal data, or redirect users, as the injected script executes with the privileges of the user viewing the page. This weakness corresponds to the Common Weakness Enumeration CWE‑79.
Affected Systems
The flaw affects the WordPress Amelia booking plugin versions up to and including 2.4.12. The CNA labels the product as TMS:Amelia. All installations of Amelia ≤2.4.12 that serve a web interface are vulnerable, and no other product variants are listed.
Risk and Exploitability
The CVSS base score of 6.5 indicates moderate severity. No EPSS score is available, so the probability of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely via the web interface, where an attacker can submit malicious input that the plugin stores and later renders, requiring only web access to the affected plugin.
