Online Scheduling and Appointment Booking System – Bookly

bookly-responsive-appointment-booking-tool · plugin

Known security vulnerabilities for Online Scheduling and Appointment Booking System – Bookly. Find out in seconds which version runs on your site with WP Lens.

20 known vulnerabilities

2 critical · 14 exploitable without logging in · 3 with public exploit code · latest Sep 30, 2026

Listed on wordpress.org · latest 28.4 · last updated Oct 1, 2026 · 60K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

CVE-2026-61949unauthenticated≤ 27.7
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
Critical 9.3
CVE-2026-93399unauthenticated≤ 28.2
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion v
Critical 9.1
CVE-2023-26526login required≤ 21.7.1
WordPress Bookly plugin <= 21.7.1 - Authenticated Arbitrary File Deletion vulnerability
High 7.7
CVE-2026-96348unauthenticated≤ 28.2
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
High 7.5
CVE-2026-89063unauthenticated≤ 28.1
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via '
High 7.5
CVE-2026-14516unauthenticated≤ 27.5
Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection
High 7.5
CVE-2026-42667unauthenticated≤ 27.4
WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability
High 7.5
CVE-2026-13424unauthenticated≤ 27.7
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
High 7.2
CVE-2026-5513unauthenticated≤ 27.2
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
High 7.2
CVE-2026-61944unauthenticated · needs a click≤ 27.7
WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2026-32540unauthenticated · needs a click≤ <= 26.7
WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2026-96347subscriber+≤ 28.2
WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability
Medium 6.5
CVE-2024-5584subscriber+≤ 23.2
WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Medium 6.4
CVE-2023-1172unauthenticated
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5
Medium 6.1
CVE-2018-6891unauthenticated · needs a click
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
Medium 6.1
CVE-2026-2520subscriber+≤ 27.2
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
Medium 5.4
CVE-2026-92799unauthenticated≤ 28.2
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Jug
Medium 5.3
CVE-2026-2519unauthenticated≤ 27.0
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
Medium 5.3
CVE-2023-1159admin
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due t
Medium 4.8
CVE-2026-12905login required≤ 27.7
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure vi
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory