CVE-2026-2520

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.

The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.

The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Insecure Direct Object Reference in the appointment() method of the Mobile Staff Cabinet API. The handler loads an Appointment by the attacker-supplied id without verifying that the appointment's staff_id matches the authenticated staff member. Authenticated attackers with staff-level mobile cabinet access can read appointment details of other staff members, including internal notes and customer data, by enumerating sequential IDs.

In Bookly versions up to 27.4, there is a vulnerability allowing unauthorized access to sensitive data.

The Bookly plugin for WordPress up to version 27.2 contains a Stored XSS vulnerability in the 'bookly-customer-full-name' cookie. An unauthenticated attacker can inject scripts that execute when an administrator visits an infected page. Requires the 'Remember personal information in cookies' setting to be enabled (disabled by default).