CVE-2023-4691

CVE-2023-4691 affects the WordPress plugin Bookly (WordPress Online Booking and Scheduling Plugin) prior to version 22.4. The vulnerability arises from improper sanitization/escaping of a parameter used in a SQL statement, enabling a SQL injection that is exploitable by high-privilege users (e.g....

CVE-2023-5209

CVE-2023-5209 affects WordPress Online Booking and Scheduling Plugin (Bookly) prior to 22.5. The vulnerability arises from insufficient sanitization/escaping of certain settings, allowing Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). ...

CVE-2023-1159

CVE-2023-1159 (Bookly WordPress plugin) stores scripts via service titles, allowing authenticated admins to inject XSS on pages. Affects Bookly up to version 21.5, with multisite and unfiltered_html-disabled installations at risk. Remediation: upgrade to a version >21.5 (Wordfence/Patchstack n...

CVE-2021-24930

The CVE-2021-24930 relates to the WordPress Bookly/Booking plugin (Bookly) for WordPress, affected in versions up to 20.3.0. The root cause is failure to escape the Staff Full Name field before output, causing a Stored Cross-Site Scripting (XSS) vulnerability. The NVD data indicates a CVSSv3.1 ba...

CVE-2023-1172

The Bookly WordPress plugin (WordPress) is affected by CVE-2023-1172, a Stored Cross‑Site Scripting (XSS) vulnerability in the full name value up to and including version 21.5, caused by insufficient input sanitization and output escaping. This could allow unauthenticated attackers to inject arbi...

CVE-2018-6891

CVE-2018-6891 affects Bookly #1 WordPress Booking Plugin Lite prior to version 14.5. The issue is a cross-site scripting (XSS) vulnerability exploited through a jQuery.ajax request to ng-payment_details_dialog.js, enabling injection of arbitrary JavaScript code into the admin panel. Affected prod...