PT-2026-99774

Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description Insufficient server-side validation of client-supplied booking quantity values allows unauthenticated users to manipulate the appointment total. By reducing the total to zero, an...

CVE-2026-86838: External Control of Assumed-Immutable Web Parameter

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step...

PT-2026-98418

Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description An issue exists where the software fails to properly verify a customer's identity before updating stored details. This allows unauthenticated attackers who possess a customer's primary...

CVE-2023-1159

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary...