84 matches found
CVE-2026-96347 WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...
EUVD-2026-72701
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Plugin Update vulnerability discovered by KoreaInfoSec in WordPress Plugin Bookly versions = 27.2...
EUVD-2026-59927
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-12905
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...
PT-2026-73131
Name of the Vulnerable Software and Affected Versions Bookly versions prior to 27.8 Description The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping...
WordPress Online Scheduling and Appointment Booking System plugin < 27.8 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Jakub Herman in WordPress Plugin Bookly versions 27.8...
CVE-2026-13395
The Online Scheduling and Appointment Booking System WordPress plugin (also known as Bookly ) versions before 27.8 is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to sanitize or properly cast a user-supplied parameter—specifically identified as staff_id—wit...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-14516
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
EUVD-2026-49720
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-14516
The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...
CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-14516
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
PT-2026-65418
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2026-61949
Unauthenticated SQL Injection in Bookly = 27.7 versions...