107 matches found
CVE-2026-13395
The CVE-2026-13395 entry concerns the WordPress plugin “Online Scheduling and Appointment Booking System” prior to version 27.8. The underlying issue is that a parameter from unauthenticated front-end booking requests is not properly sanitized or cast before being used in a SQL query, enabling un...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-14516
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
EUVD-2026-49720
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-14516
The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...
CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
EUVD-2026-48207
Unauthenticated SQL Injection in Bookly = 27.7 versions...
CVE-2026-61949
CVE-2026-61949 describes an unauthenticated SQL injection in the WordPress plugin Bookly (versions
EUVD-2026-48203
Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...
CVE-2026-61944
The CVE-2026-61944 entry concerns an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Bookly plugin, affecting versions up to 27.7. The issue lies in the Bookly plugin for WordPress and is exploitable over the network with user interaction required. CVSS v3.1 metrics indi...
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dodoh4t in WordPress Plugin Bookly versions = 27.7...
WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ickogz in WordPress Plugin Bookly versions = 27.7...
CVE-2026-42667
Unauthenticated Sensitive Data Exposure in Bookly = 27.4 versions...
CVE-2026-42667
The CVE details an unauthenticated sensitive data exposure in the WordPress Bookly plugin, version
EUVD-2026-36832
Unauthenticated Sensitive Data Exposure in Bookly = 27.4 versions...
CVE-2026-42667 WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Bookly = 27.4 versions...
CVE-2026-42667 WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Bookly = 27.4 versions...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin Bookly versions = 27.2...
