Bookly Responsive Appointment Booking Tool Vulnerabilities

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVSS:

7.2

Affected:

up to 27.7

Fixed in:

28.0

Disclosed:

Aug 15, 2026

CVE-2026-13424 on NVD →

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is d...

CVSS:

4.3

Affected:

up to 27.7

Fixed in:

28.0

Disclosed:

Aug 15, 2026

CVE-2026-12905 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to SQL Injection in versions up to 27.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appen...

CVSS:

7.5

Affected:

up to 27.8

Fixed in:

27.8

Disclosed:

Aug 3, 2026

CVE-2026-13395 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query....

CVSS:

7.5

Affected:

up to 27.7

Fixed in:

27.8

Disclosed:

Jul 27, 2026

CVE-2026-14516 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 27.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated at...

CVSS:

7.5

Affected:

up to 27.7

Fixed in:

27.8

Disclosed:

Jul 16, 2026

CVE-2026-61949 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

7.2

Affected:

up to 27.7

Fixed in:

27.8

Disclosed:

Jul 16, 2026

CVE-2026-61944 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVSS:

7.2

Affected:

up to 27.2

Fixed in:

27.3

Disclosed:

Jun 12, 2026

CVE-2026-5513 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 27.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 27.4

Fixed in:

27.5

Disclosed:

May 10, 2026

CVE-2026-42667 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it...

CVSS:

5.3

Affected:

up to 27.0

Fixed in:

27.1

Disclosed:

Apr 8, 2026

CVE-2026-2519 on NVD →

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 26.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pa...

CVSS:

6.1

Affected:

up to 26.7

Fixed in:

26.8

Disclosed:

Mar 20, 2026

CVE-2026-32540 on NVD →

The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with th...

CVSS:

6.4

Affected:

up to 23.2

Fixed in:

23.3

Disclosed:

Jun 10, 2024

CVE-2024-5584 on NVD →

The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 22.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator...

CVSS:

4.4

Affected:

up to 22.4.1

Fixed in:

22.5

Disclosed:

Nov 6, 2023

CVE-2023-5209 on NVD →

The Bookly plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 22.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrato...

CVSS:

6.6

Affected:

up to 22.3.1

Fixed in:

22.4

Disclosed:

Sep 25, 2023

CVE-2023-4691 on NVD →

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages th...

CVSS:

4

Affected:

21.7 – 21.7

Fixed in:

21.8

Disclosed:

Jun 1, 2023

CVE-2023-1159 on NVD →

The Bookly plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including, 21.7.1. This makes it possible for authenticated attackers with staff-level access to delete arbitrary files on the affected site's server which may make a site takeover possible.

CVSS:

8.1

Affected:

up to 21.7.1

Fixed in:

21.8

Disclosed:

May 11, 2023

CVE-2023-26526 on NVD →

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever...

CVSS:

7.2

Affected:

21.5 – 21.5

Fixed in:

21.5.1

Disclosed:

Mar 17, 2023

CVE-2023-1172 on NVD →

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

CVSS:

5.4

Affected:

up to 20.3

Fixed in:

20.3.1

Disclosed:

Nov 8, 2021

CVE-2021-24930 on NVD →

The Online Booking and Scheduling plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 14.5. This is due to insufficient input sanitization and output escaping on the name parameter of a booking submission which makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

7.2

Affected:

up to 14.5

Fixed in:

14.6

Disclosed:

Feb 10, 2018

CVE-2018-6891 on NVD →