Plugin icon

Online Scheduling and Appointment Booking System – Bookly

bookly-responsive-appointment-booking-tool

Vulnerabilities:

30

Last Updated:

October 13, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-10-09
Title
Online Scheduling and Appointment Booking System < 28.3 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
Fixed in
Fixed in 28.3
CVSS
7.2 (high)
Published
2026-10-09
Title
Online Scheduling and Appointment Booking System < 28.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Fixed in
Fixed in 28.5
CVSS
6.8 (medium)
Published
2026-10-09
Title
Online Scheduling and Appointment Booking System < 28.5 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
Fixed in
Fixed in 28.5
CVSS
5.3 (medium)
Published
2026-09-25
Title
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
Fixed in
Fixed in 28.3
CVSS
5.3 (medium)
Published
2026-09-25
Title
Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
Fixed in
Fixed in 28.3
CVSS
3.8 (low)
Published
2026-09-25
Title
Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass
Fixed in
Fixed in 28.3
CVSS
5.3 (medium)
Published
2026-09-25
Title
Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options
Fixed in
Fixed in 28.3
CVSS
4.7 (medium)
Published
2026-09-24
Title
Online Scheduling and Appointment Booking System – Bookly < 28.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 28.3
CVSS
4.3 (medium)
Published
2026-09-24
Title
Online Scheduling and Appointment Booking System – Bookly < 28.3 - Missing Authorization
Fixed in
Fixed in 28.3
CVSS
5.3 (medium)
Published
2026-09-24
Title
Online Scheduling and Appointment Booking System < 28.3 - Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Fixed in
Fixed in 28.3
CVSS
6.5 (medium)
Published
2026-09-17
Title
Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR
Fixed in
Fixed in 28.2
CVSS
4.8 (medium)
Published
2026-09-15
Title
Online Scheduling and Appointment Booking System < 28.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Fixed in
Fixed in 28.2
CVSS
7.5 (high)
Published
2026-09-07
Title
Online Scheduling and Appointment Booking System – Bookly < 27.3 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
Fixed in
Fixed in 27.3
CVSS
5.4 (medium)
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System < 28.0 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
Fixed in
Fixed in 28.0
CVSS
7.2 (high)
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System – Bookly < 28.0 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Fixed in
Fixed in 28.0
CVSS
4.3 (medium)
Published
2026-07-27
Title
Online Scheduling and Appointment Booking System < 27.8 - Unauthenticated SQL Injection
Fixed in
Fixed in 27.8
CVSS
7.5 (high)
Published
2026-07-16
Title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 27.8
CVSS
7.2 (high)
Published
2026-07-16
Title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
Fixed in
Fixed in 27.8
CVSS
7.5 (high)
Published
2026-07-13
Title
Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
Fixed in
Fixed in 27.8
CVSS
8.6 (high)
Published
2026-06-12
Title
Online Scheduling and Appointment Booking System – Bookly < 27.3 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
Fixed in
Fixed in 27.3
CVSS
7.2 (high)
Published
2026-05-10
Title
Online Scheduling and Appointment Booking System – Bookly < 27.5 - Unauthenticated Information Exposure
Fixed in
Fixed in 27.5
CVSS
5.3 (medium)
Published
2026-04-08
Title
Bookly < 27.1 - Unauthenticated Price Manipulation via 'tips'
Fixed in
Fixed in 27.1
CVSS
5.3 (medium)
Published
2026-03-20
Title
Online Scheduling and Appointment Booking System – Bookly < 26.8 - Reflected Cross-Site Scripting
Fixed in
Fixed in 26.8
CVSS
6.1 (medium)
Published
2024-06-10
Title
WordPress Online Booking and Scheduling Plugin – Bookly < 23.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Fixed in
Fixed in 23.3
CVSS
6.4 (medium)
Published
2023-11-06
Title
Bookly < 22.5 - Admin+ Stored XSS
Fixed in
Fixed in 22.5
CVSS
3.5 (low)
Published
2023-09-25
Title
Bookly < 22.4 - Admin+ SQLi
Fixed in
Fixed in 22.4
CVSS
4.1 (medium)
Published
2023-06-01
Title
Bookly < 21.8 - Admin+ Stored Cross-Site Scripting via service titles
Fixed in
Fixed in 21.8
CVSS
4.0 (medium)
Published
2023-03-17
Title
Bookly < 21.6 - Unauthenticated Stored XSS
Fixed in
Fixed in 21.6
CVSS
8.8 (high)
Published
2021-11-08
Title
Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting
Fixed in
Fixed in 20.3.1
CVSS
5.4 (medium)
Published
2018-02-10
Title
Bookly #1 WordPress Booking Plugin (Lite) < 14.5 – Unauthenticated Blind Stored XSS
Fixed in
Fixed in 14.5
CVSS
6.1 (medium)