WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bookly-responsive-appointment-booking-tool
Published
2024-06-10
Title
WordPress Online Booking and Scheduling Plugin – Bookly < 23.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Slug
bookly-responsive-appointment-booking-tool
Published
2026-03-20
Title
Online Scheduling and Appointment Booking System – Bookly < 26.8 - Reflected Cross-Site Scripting
Slug
bookly-responsive-appointment-booking-tool
Published
2026-04-08
Title
Bookly < 27.1 - Unauthenticated Price Manipulation via 'tips'
Slug
bookly-responsive-appointment-booking-tool
Published
2026-05-10
Title
Online Scheduling and Appointment Booking System – Bookly < 27.5 - Unauthenticated Information Exposure
Slug
bookly-responsive-appointment-booking-tool
Published
2026-06-12
Title
Online Scheduling and Appointment Booking System – Bookly < 27.3 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-13
Title
Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-16
Title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated Stored Cross-Site Scripting
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-16
Title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
Slug
bookly-responsive-appointment-booking-tool
Published
2026-07-27
Title
Online Scheduling and Appointment Booking System < 27.8 - Unauthenticated SQL Injection
Slug
bookly-responsive-appointment-booking-tool
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System – Bookly < 28.0 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Slug
bookly-responsive-appointment-booking-tool
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System < 28.0 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
Slug
bookmarkify
Published
2015-08-09
Title
Bookmarkify <= 2.9.2 - Cross-Site Scripting (XSS) & CSRF
Slug
bookme-free-appointment-booking-system
Published
2025-11-24
Title
Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter
Slug
booknetic
Published
2025-02-24
Title
Booknetic <= 4.0.9 - Cross-Site Request Forgery
Slug
booknetic
Published
2025-03-05
Title
Booknetic < 4.1.5 - Staff Creation via CSRF
Slug
booknetic
Published
2026-06-01
Title
Booknetic <= 4.8.5 - Missing Authorization
Slug
bookr
Published
2026-02-13
Title
Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification
Slug
books-papers
Published
2022-03-29
Title
Books & Papers <= 0.20210223 - Admin+ Stored Cross-Site Scripting
Slug
bookshelf
Published
2021-06-28
Title
Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
bookster
Published
2024-06-05
Title
Bookster < 1.2.0 - Unauthenticated Appointment Status Update
Slug
bookster
Published
2026-02-17
Title
Bookster – WordPress Appointment Booking Plugin < 2.2.0 - Authenticated (Administrator+) SQL Injection via 'raw'
Slug
booktics
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Addons Installation
Slug
booktics
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Get Items via REST API endpoints
Slug
booktics
Published
2026-02-02
Title
Booktics < 1.0.17 - Missing Authorization
Slug
booktics
Published
2026-06-29
Title
Booktics < 1.0.22 - Unauthenticated PHP Object Injection