CVE-2026-14516

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...

CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

EUVD-2026-49720

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-65418

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-14516: Improper Neutralization of Special Elements used in an SQL Command

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-61944

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

CVE-2026-61949

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61949

CVE-2026-61949 describes an unauthenticated SQL injection in the WordPress plugin Bookly (versions

CVE-2026-61949 WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61949 WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in Bookly = 27.7 versions...

EUVD-2026-48207

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61944 WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

EUVD-2026-48203

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

CVE-2026-61944 WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

CVE-2026-61944

The CVE-2026-61944 entry concerns an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Bookly plugin, affecting versions up to 27.7. The issue lies in the Bookly plugin for WordPress and is exploitable over the network with user interaction required. CVSS v3.1 metrics indi...

PT-2026-63861

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

PT-2026-63865

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61949: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61944: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dodoh4t in WordPress Plugin Bookly versions = 27.7...