CVE-2026-13424

creationtimestamp| type| source ---|---|--- 2026-08-16 08:44:15+00:00| seen| https://bsky.app/profile/suriq.io/post/3mt6sbibgd22p 2026-08-16 09:35:26+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mt6v52kmjl2r 2026-08-16 13:16:12+00:00| seen|...

CVE-2026-13424 Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...