← back to popular plugins
wordfence / plugin · bookly-responsive-appointment-booking-tool
Online Scheduling and Appointment Booking System – Bookly
bookly-responsive-appointment-booking-tool
total installs
70,000
total vulns
2
critical
0
high
0
medium
2
low
0
latest vuln
—
patched
2
unpatched
0
avg time to patch
—
vulnerabilities
(2)
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
medium
✓ patched
cve id
CVE-2026-2519 ↗
cvss score
5.3
cwe
CWE-472: External Control of Assumed-Immutable Web Parameter
published
Apr 8, 2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.
Online Scheduling and Appointment Booking System – Bookly <= 26.7 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-32540 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Mar 20, 2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 26.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.