CVE-2026-5513
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Bookly plugin for WordPress up to version 27.2 contains a Stored XSS vulnerability in the 'bookly-customer-full-name' cookie. An unauthenticated attacker can inject scripts that execute when an administrator visits an infected page. Requires the 'Remember personal information in cookies' setting to be enabled (disabled by default).
Risk Assessment
An attacker can steal administrator sessions, redirect users, or perform other malicious actions in the context of the WordPress admin panel.
Recommendation
Update the Bookly plugin to the latest version. Disable the 'Remember personal information in cookies' setting if not required.
Other vulnerabilities in Bookly
See all- CVE-2026-61944High
The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-61949Critical
The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.
- CVE-2026-13424High
The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.
- CVE-2026-12905Medium
The Bookly plugin for WordPress up to version 27.7 is vulnerable to Insecure Direct Object Reference in the appointment() method of the Mobile Staff Cabinet API. The handler loads an Appointment by the attacker-supplied id without verifying that the appointment's staff_id matches the authenticated staff member. Authenticated attackers with staff-level mobile cabinet access can read appointment details of other staff members, including internal notes and customer data, by enumerating sequential IDs.
- CVE-2026-42667High
In Bookly versions up to 27.4, there is a vulnerability allowing unauthorized access to sensitive data.
Original NVD description (English source)
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires 'Remember personal information in cookies' setting to be enabled (disabled by default).