CVE-2023-4691

CVE-2023-4691 affects the WordPress plugin Bookly (WordPress Online Booking and Scheduling Plugin) prior to version 22.4. The vulnerability arises from improper sanitization/escaping of a parameter used in a SQL statement, enabling a SQL injection that is exploitable by high-privilege users (e.g....

CVE-2021-24930

The CVE-2021-24930 relates to the WordPress Bookly/Booking plugin (Bookly) for WordPress, affected in versions up to 20.3.0. The root cause is failure to escape the Staff Full Name field before output, causing a Stored Cross-Site Scripting (XSS) vulnerability. The NVD data indicates a CVSSv3.1 ba...

CVE-2023-1172

The Bookly WordPress plugin (WordPress) is affected by CVE-2023-1172, a Stored Cross‑Site Scripting (XSS) vulnerability in the full name value up to and including version 21.5, caused by insufficient input sanitization and output escaping. This could allow unauthenticated attackers to inject arbi...

CVE-2018-6891

CVE-2018-6891 affects Bookly #1 WordPress Booking Plugin Lite prior to version 14.5. The issue is a cross-site scripting (XSS) vulnerability exploited through a jQuery.ajax request to ng-payment_details_dialog.js, enabling injection of arbitrary JavaScript code into the admin panel. Affected prod...