CVE-2026-61944

The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Insecure Direct Object Reference in the appointment() method of the Mobile Staff Cabinet API. The handler loads an Appointment by the attacker-supplied id without verifying that the appointment's staff_id matches the authenticated staff member. Authenticated attackers with staff-level mobile cabinet access can read appointment details of other staff members, including internal notes and customer data, by enumerating sequential IDs.

In Bookly versions up to 27.4, there is a vulnerability allowing unauthorized access to sensitive data.

The Bookly plugin for WordPress up to version 27.2 contains a Stored XSS vulnerability in the 'bookly-customer-full-name' cookie. An unauthenticated attacker can inject scripts that execute when an administrator visits an infected page. Requires the 'Remember personal information in cookies' setting to be enabled (disabled by default).