Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-61949

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Blind SQL Injection.This issue affects Bookly: from n/a through 27.7.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-86837

Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-91847

Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-13395

Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-61944

WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-42667

WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-32540

WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through <= 26.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress