Vulnerabilities and security researches forbookly-responsive-appointment-booking-tool bookly-responsive-appointment-booking-tool

May 22, 2026

CVE, Research URL: CVE-2026-42667
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: -
Research Description: Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 27.5 CVE-2026-42667
Affected versions: max 27.5.
Status: vulnerable

Apr 13, 2026

CVE, Research URL: CVE-2026-2519
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Apr 09, 2026
Research Description: The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.
Affected versions: max 27.1.
Status: vulnerable

Mar 29, 2026

CVE, Research URL: CVE-2026-32540
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Mar 25, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through <= 26.7.
Affected versions: max 26.7.
Status: vulnerable

Jun 14, 2024

CVE, Research URL: CVE-2024-5584
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Jun 11, 2024
Research Description: The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the staff member role and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 23.3.
Status: vulnerable

Jun 06, 2024

CVE, Research URL: CVE-2023-5209
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Nov 27, 2023
Research Description: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions: max 22.5.
Status: vulnerable

CVE, Research URL: CVE-2021-24930
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Dec 06, 2021
Research Description: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
Affected versions: max 20.3.1.
Status: vulnerable

CVE, Research URL: CVE-2023-26526
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: May 17, 2024
Research Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1.
Affected versions: max 21.8.
Status: vulnerable

CVE, Research URL: CVE-2023-1159
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Jun 02, 2023
Research Description: The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions: max 21.8.
Status: vulnerable

CVE, Research URL: CVE-2023-4691
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Oct 17, 2023
Research Description: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Affected versions: max 22.4.
Status: vulnerable

CVE, Research URL: CVE-2023-1172
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Mar 17, 2023
Research Description: The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 21.6.
Status: vulnerable

CVE, Research URL: CVE-2018-6891
Home page URL: Security reports for WordPress Online Booking and Scheduling Plugin – Bookly
Application: WordPress Online Booking and Scheduling Plugin – Bookly
Date: Feb 11, 2018
Research Description: Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
Affected versions: max 14.6.
Status: vulnerable