{"id":"CVE-2026-116396","kind":"vulnerability","aliases":["CVE-2026-116396"],"related":[],"title":"TMS Amelia booking plugin: stored XSS through version 2.4.12","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.","summary":"The Amelia booking plugin for WordPress (ameliabooking) fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can submit content that is later rendered can run JavaScript in the browser of other users, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amelia-booking","package","wordpress"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:14+00:00","updated_at":"2026-10-26T17:33:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T17:33:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TMS Amelia booking plugin: stored XSS through version 2.4.12","impact":"medium","summary":"The Amelia booking plugin for WordPress (ameliabooking) fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can submit content that is later rendered can run JavaScript in the browser of other users, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","amelia-booking"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers, possibly admins.","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and which input and privilege level are required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000505,"input_tokens":3306,"output_tokens":349,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116396':12A,15A '-2026':11A,14A '2.4.12':9A,88C 'administr':61B 'affect':83C 'allow':35B,79C 'amelia':2A,17B,22B,77C,84C 'amelia-book':16B 'ameliabook':27B,78C 'attack':42B 'book':3A,18B,23B 'browser':56B 'content':46B 'cross':38B,71C 'cross-sit':37B,70C 'cve':10A,13A 'fail':28B 'generat':33B,69C 'improp':62C 'includ':60B 'input':31B,65C 'issu':82C 'javascript':53B 'later':49B 'n/a':86C 'neutral':30B,63C 'packag':19B 'page':34B,68C 'plugin':4A,24B 'render':50B 'run':52B 'script':40B,73C 'site':39B,72C 'store':5A,36B,80C 'submit':45B 'tms':1A,76C 'user':59B 'version':8A 'vulner':74C 'web':67C 'wordpress':20B,26B 'xss':6A 'xss.this':81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116396","severity":null,"published_at":"2026-10-26T17:17:26+00:00","modified_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}