241 matches found
Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access
Bookly WordPress plugin = 28.1 contains an insecure direct object reference caused by missing validation on 'conversationid' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication. id: CVE-2026-89063 info: name:...
CVE-2026-12626
The Bookly plugin for WordPress (versions up to and including 28.2 ) is vulnerable to PHP Object Injection due to the deserialization of untrusted input via the 'value' parameter . This flaw allows authenticated attackers with custom-level access or higher to inject a PHP Object. While a vulnerab...
EUVD-2026-96221
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-lev...
CVE-2026-12626 Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-lev...
CVE-2026-103365
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 28.4 . The vulnerability exists in the bookly_render_details endpoint, which is registered for both wp_ajax and wp_ajax_nopriv. Becaus...
EUVD-2026-96040
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...
EUVD-2026-96035
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-104898
The Bookly plugin for WordPress (versions up to and including 28.4 ) is vulnerable to an Insecure Direct Object Reference (IDOR) due to a lack of validation on the id and wp_user_id parameters. Authenticated attackers with subscriber-level access and above can overwrite the WordPress account bind...
CVE-2026-5513
CVE-2026-5513 — Bookly ≤ 27.2 Хранимая XSS через Cookie Обзор Поле| Значение ---|--- CVE ID| CVE-2026-5513 Уязвимость| Хранимая межсайтовая атака XSS Плагин| Bookly — Система онлайн-записи и бронирования Затронутые версии| ≤ 27.2 Исправлено в| 27.3+ CVSS 3.1| 7.2 Высокий —...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Bookly versions = 28.4...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details vulnerability
Unauthenticated Sensitive Information Exposure in 'phone' Parameter to booklyrenderdetails vulnerability discovered by R3D in WordPress Plugin Bookly versions = 28.4...
CVE-2026-93399
CVE-2026-93399 — Bookly IDOR 주문 토큰 노출 및 예약 롤백 Booklybookly-responsive-appointment-booking-tool의 CVE-2026-93399에 대한 Python 3 PoC입니다. 설명 PoCbit / GitHub CVE-2026-93399 — Bookly ≤ 28.2 는 공개 예약 AJAX에서 안전하지 않은 직접 객체 참조CWE-639 취약점이 존재합니다: booklygetformid는 공격자가 제어하는 orderid를 폼 세션에 저장하고,...
CVE-2026-5513
CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2: хранимый XSS через Cookie CVE-2026-5513 — Bookly ≤ 27.2: хранимый XSS через Cookie CVE CVSS Тип Auth https://t.me/FreeToolsCpa Файл CVE в группе Обзор Поле Значение CVE ID CVE-2026-5513 Уязвимость Хранимая межсайтовая подмена...
CVE-2026-96347
Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...
CVE-2026-96348
Unauthenticated Broken Access Control in Bookly = 28.2 versions...
CVE-2026-96348 WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Bookly = 28.2 versions...
EUVD-2026-89861
Unauthenticated Broken Access Control in Bookly = 28.2 versions...
CVE-2026-96348
The Bookly WordPress plugin (versions