WordPress plugin

Online Scheduling and Appointment Booking System – Bookly security & vulnerabilities

Q: Does Online Scheduling and Appointment Booking System – Bookly have known vulnerabilities?

Yes. VulnCrest Radar lists 32 known vulnerabilities in Online Scheduling and Appointment Booking System – Bookly: 1 critical, 12 high, 19 medium. None are known to affect version null.

Q: How do I check which version of Online Scheduling and Appointment Booking System – Bookly I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Online Scheduling and Appointment Booking System – Bookly vulnerability?

CVE-2026-12626, published Oct 9, 2026: Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter. Severity: High (CVSS 7.2).

Q: Is any Online Scheduling and Appointment Booking System – Bookly vulnerability listed in CISA KEV?

No. None of the known Online Scheduling and Appointment Booking System – Bookly vulnerabilities is currently listed in the CISA KEV catalog.

bookly-responsive-appointment-booking-tool— active installsLast vulnerability Oct 9, 2026

No known unpatched vulnerabilities in the latest version

All 32 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

32Known vulnerabilities

Critical1
High12
Medium19
Low0

Vulnerabilities per year

All Online Scheduling and Appointment Booking System – Bookly vulnerabilities

Online Scheduling and Appointment Booking System – Bookly vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Authenticated (Custom+) PHP Object Injection via 'value' Parameter ≤28.2Update to 28.3	CVE-2026-12626	Oct 09
High7.5	28.2 - Authenticated (Bookly Administrator+) PHP Object Injection 23.2 – 28.2Update to 28.3	CVE-2026-86841	Sep 25
Critical9.1	Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter ≤28.2Update to 28.3	CVE-2026-93399	Sep 24
High7.5	Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter ≤28.1Update to 28.2	CVE-2026-89063	Sep 15
High7.2	Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action ≤27.7Update to 28.0	CVE-2026-13424	Aug 15
High7.5	Unauthenticated SQL Injection <27.8Update to 27.8	CVE-2026-13395	Aug 03
High7.5	Unauthenticated SQL Injection ≤27.7Update to 27.8	CVE-2026-14516	Jul 27
High7.2	Unauthenticated Stored Cross-Site Scripting ≤27.7Update to 27.8	CVE-2026-61944	Jul 16
High7.5	Unauthenticated SQL Injection ≤27.7Update to 27.8	CVE-2026-61949	Jul 16
High7.2	Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie ≤27.2Update to 27.3	CVE-2026-5513	Jun 12
High8.1	Arbitrary File Deletion ≤21.7.1Update to 21.8	CVE-2023-26526	May 11, 2023
High7.2	Unauthenticated Stored Cross-Site Scripting via Name 21.5 – 21.5Update to 21.5.1	CVE-2023-1172	Mar 17, 2023
High7.2	Cross-Site Scripting ≤14.5Update to 14.6	CVE-2018-6891	Feb 10, 2018

High7.2
Authenticated (Custom+) PHP Object Injection via 'value' Parameter
≤28.2Update to 28.3
CVE-2026-12626Oct 09
High7.5
28.2 - Authenticated (Bookly Administrator+) PHP Object Injection
23.2 – 28.2Update to 28.3
CVE-2026-86841Sep 25
Critical9.1
Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
≤28.2Update to 28.3
CVE-2026-93399Sep 24
High7.5
Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
≤28.1Update to 28.2
CVE-2026-89063Sep 15
High7.2
Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
≤27.7Update to 28.0
CVE-2026-13424Aug 15
High7.5
Unauthenticated SQL Injection
<27.8Update to 27.8
CVE-2026-13395Aug 03
High7.5
Unauthenticated SQL Injection
≤27.7Update to 27.8
CVE-2026-14516Jul 27
High7.2
Unauthenticated Stored Cross-Site Scripting
≤27.7Update to 27.8
CVE-2026-61944Jul 16
High7.5
Unauthenticated SQL Injection
≤27.7Update to 27.8
CVE-2026-61949Jul 16
High7.2
Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
≤27.2Update to 27.3
CVE-2026-5513Jun 12
High8.1
Arbitrary File Deletion
≤21.7.1Update to 21.8
CVE-2023-26526May 11, 2023
High7.2
Unauthenticated Stored Cross-Site Scripting via Name
21.5 – 21.5Update to 21.5.1
CVE-2023-1172Mar 17, 2023
High7.2
Cross-Site Scripting
≤14.5Update to 14.6
CVE-2018-6891Feb 10, 2018

Online Scheduling and Appointment Booking System – Bookly: common questions

Does Online Scheduling and Appointment Booking System – Bookly have known vulnerabilities?

Yes. VulnCrest Radar lists 32 known vulnerabilities in Online Scheduling and Appointment Booking System – Bookly: 1 critical, 12 high, 19 medium. None are known to affect version null.

How do I check which version of Online Scheduling and Appointment Booking System – Bookly I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Online Scheduling and Appointment Booking System – Bookly vulnerability?

CVE-2026-12626, published Oct 9, 2026: Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter. Severity: High (CVSS 7.2).

Is any Online Scheduling and Appointment Booking System – Bookly vulnerability listed in CISA KEV?

No. None of the known Online Scheduling and Appointment Booking System – Bookly vulnerabilities is currently listed in the CISA KEV catalog.