WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bookly-responsive-appointment-booking-tool
Published
2023-06-01
Title
Bookly < 21.8 - Admin+ Stored Cross-Site Scripting via service titles
Slug
bookly-responsive-appointment-booking-tool
Published
2023-09-25
Title
Bookly < 22.4 - Admin+ SQLi
Slug
bookly-responsive-appointment-booking-tool
Published
2023-11-06
Title
Bookly < 22.5 - Admin+ Stored XSS
Slug
bookly-responsive-appointment-booking-tool
Published
2024-06-10
Title
WordPress Online Booking and Scheduling Plugin – Bookly < 23.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Slug
bookly-responsive-appointment-booking-tool
Published
2026-03-20
Title
Online Scheduling and Appointment Booking System – Bookly < 26.8 - Reflected Cross-Site Scripting
Slug
bookly-responsive-appointment-booking-tool
Published
2026-04-08
Title
Bookly < 27.1 - Unauthenticated Price Manipulation via 'tips'
Slug
bookly-responsive-appointment-booking-tool
Published
2026-05-10
Title
Online Scheduling and Appointment Booking System – Bookly < 27.5 - Unauthenticated Information Exposure
Slug
bookly-responsive-appointment-booking-tool
Published
2026-06-12
Title
Online Scheduling and Appointment Booking System – Bookly < 27.3 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-13
Title
Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-16
Title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated Stored Cross-Site Scripting
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-16
Title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-27
Title
Online Scheduling and Appointment Booking System < 27.8 - Unauthenticated SQL Injection
Slug
bookly-responsive-appointment-booking-tool
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System – Bookly < 28.0 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Slug
bookly-responsive-appointment-booking-tool
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System < 28.0 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-07
Title
Online Scheduling and Appointment Booking System – Bookly < 27.3 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-15
Title
Online Scheduling and Appointment Booking System < 28.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-17
Title
Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-24
Title
Online Scheduling and Appointment Booking System < 28.3 - Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-24
Title
Online Scheduling and Appointment Booking System – Bookly < 28.3 - Missing Authorization
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-25
Title
Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-25
Title
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-24
Title
Online Scheduling and Appointment Booking System – Bookly < 28.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-25
Title
Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options
Slug
bookly-responsive-appointment-booking-tool
Published
2026-09-25
Title
Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
Slug
bookly-responsive-appointment-booking-tool
Published
2026-10-09
Title
Online Scheduling and Appointment Booking System < 28.3 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter