WordPress plugin
Online Scheduling and Appointment Booking System – Bookly security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 32 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High12
- Medium19
- Low0
All Online Scheduling and Appointment Booking System – Bookly vulnerabilities
- High7.2Authenticated (Custom+) PHP Object Injection via 'value' Parameter
≤28.2Update to 28.3
- Medium6.8Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
≤28.4Update to 28.5
- Medium5.3Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
≤28.4Update to 28.5
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
≤28.2Update to 28.3
- Medium5.3Unauthenticated Payment Bypass
≤28.2Update to 28.3
- High7.528.2 - Authenticated (Bookly Administrator+) PHP Object Injection
23.2 – 28.2Update to 28.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤28.2Update to 28.3
- Critical9.1Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
≤28.2Update to 28.3
- Medium5.3Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
≤28.2Update to 28.3
- Medium5.3Missing Authorization
≤28.2Update to 28.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤28.2Update to 28.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤28.1Update to 28.2
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
≤28.1Update to 28.2
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
≤27.2Update to 27.3
- High7.2Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
≤27.7Update to 28.0
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
≤27.7Update to 28.0
- High7.5Unauthenticated SQL Injection
<27.8Update to 27.8
- High7.5Unauthenticated SQL Injection
≤27.7Update to 27.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤27.7Update to 27.8
- High7.5Unauthenticated SQL Injection
≤27.7Update to 27.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
≤27.2Update to 27.3
- Medium5.3Unauthenticated Information Exposure
≤27.4Update to 27.5
- Medium5.3Unauthenticated Price Manipulation via 'tips'
≤27.0Update to 27.1
- Medium6.1Reflected Cross-Site Scripting
≤26.7Update to 26.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
≤23.2Update to 23.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤22.4.1Update to 22.5
- Medium6.6Authenticated(Administrator+) SQL Injection
≤22.3.1Update to 22.4
- Medium4.0Authenticated (Admin+) Stored Cross-Site Scripting
21.7 – 21.7Update to 21.8
- High8.1Arbitrary File Deletion
≤21.7.1Update to 21.8
- High7.2Unauthenticated Stored Cross-Site Scripting via Name
21.5 – 21.5Update to 21.5.1
- Medium5.4Staff Member Stored Cross-Site Scripting
≤20.3Update to 20.3.1
- High7.2Cross-Site Scripting
≤14.5Update to 14.6
Online Scheduling and Appointment Booking System – Bookly: common questions
Does Online Scheduling and Appointment Booking System – Bookly have known vulnerabilities?
Yes. VulnCrest Radar lists 32 known vulnerabilities in Online Scheduling and Appointment Booking System – Bookly: 1 critical, 12 high, 19 medium. None are known to affect version null.
How do I check which version of Online Scheduling and Appointment Booking System – Bookly I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Online Scheduling and Appointment Booking System – Bookly vulnerability?
CVE-2026-12626, published Oct 9, 2026: Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter. Severity: High (CVSS 7.2).
Is any Online Scheduling and Appointment Booking System – Bookly vulnerability listed in CISA KEV?
No. None of the known Online Scheduling and Appointment Booking System – Bookly vulnerabilities is currently listed in the CISA KEV catalog.