CVE-2026-66687
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.
Risk Assessment
A customer can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update the WpBookingly plugin to a version newer than 1.3.2.
Other vulnerabilities in WpBookingly
See all- CVE-2026-25444Medium
The WpBookingly plugin for WordPress up to version 1.2.9 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-27405Medium
Missing authorization vulnerability in the WpBookingly plugin for WordPress allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS