EN ES
Start free
Menu

Online Scheduling and Appointment Booking System – Bookly: known security problems

32 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 32 known security problems on this page. Each one has a fixed version. Updating to version 28.5 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could in some setups, take over your site (up to and including 28.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-12626
Report title
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.4
Fixed in
28.5
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.5 or newer.
Official ID
CVE-2026-104898
Report title
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
First reported
Sources
This week

A stranger could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.4
Fixed in
28.5
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.5 or newer.
Official ID
CVE-2026-103365
Report title
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 28.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-86838
Report title
Bookly <= 28.2 - Unauthenticated Payment Bypass
First reported
Sources
This week

Someone could in some setups, take over your site (from 23.2 up to and including 28.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 23.2 up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-86841
Report title
Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection
First reported
Sources
This week

Someone could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-86839
Report title
Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 28.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-86837
Report title
Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 28.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-93399
Report title
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 28.2) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-92799
Report title
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
First reported
Sources
This week

Someone could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-96348
Report title
Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.2
Fixed in
28.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.3 or newer.
Official ID
CVE-2026-96347
Report title
Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 28.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.1
Fixed in
28.2
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.2 or newer.
Official ID
CVE-2026-91847
Report title
Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 28.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 28.1
Fixed in
28.2
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.2 or newer.
Official ID
CVE-2026-89063
Report title
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.2
Fixed in
27.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.3 or newer.
Official ID
CVE-2026-2520
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 27.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.7
Fixed in
28.0
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.0 or newer.
Official ID
CVE-2026-13424
Report title
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
First reported
Sources
This week

Someone could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.7
Fixed in
28.0
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 28.0 or newer.
Official ID
CVE-2026-12905
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
First reported
Sources
This week

A stranger could read or change the data in your site’s database (before 27.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 27.8
Fixed in
27.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.8 or newer.
Official ID
CVE-2026-13395
Report title
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 27.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.7
Fixed in
27.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.8 or newer.
Official ID
CVE-2026-14516
Report title
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 27.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.7
Fixed in
27.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.8 or newer.
Official ID
CVE-2026-61944
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 27.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.7
Fixed in
27.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.8 or newer.
Official ID
CVE-2026-61949
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated SQL Injection
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 27.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.2
Fixed in
27.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.3 or newer.
Official ID
CVE-2026-5513
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 27.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.4
Fixed in
27.5
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.5 or newer.
Official ID
CVE-2026-42667
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 27.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 27.0
Fixed in
27.1
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 27.1 or newer.
Official ID
CVE-2026-2519
Report title
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 26.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 26.7
Fixed in
26.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 26.8 or newer.
Official ID
CVE-2026-32540
Report title
Online Scheduling and Appointment Booking System – Bookly <= 26.7 - Reflected Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 23.2
Fixed in
23.3
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 23.3 or newer.
Official ID
CVE-2024-5584
Report title
WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 22.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 22.4.1
Fixed in
22.5
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 22.5 or newer.
Official ID
CVE-2023-5209
Report title
WordPress Online Booking and Scheduling Plugin – Bookly <= 22.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 22.3.1
Fixed in
22.4
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 22.4 or newer.
Official ID
CVE-2023-4691
Report title
Bookly <= 22.3.1 - Authenticated(Administrator+) SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 21.7 up to and including 21.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 21.7 up to and including 21.7
Fixed in
21.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 21.8 or newer.
Official ID
CVE-2023-1159
Report title
Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 21.7.1
Fixed in
21.8
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 21.8 or newer.
Official ID
CVE-2023-26526
Report title
Bookly <= 21.7.1 - Arbitrary File Deletion
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (from 21.5 up to and including 21.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 21.5 up to and including 21.5
Fixed in
21.5.1
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 21.5.1 or newer.
Official ID
CVE-2023-1172
Report title
Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 20.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 20.3
Fixed in
20.3.1
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 20.3.1 or newer.
Official ID
CVE-2021-24930
Report title
Bookly <= 20.3 - Staff Member Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 14.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 14.5
Fixed in
14.6
What to do
If your site has an affected version, update Online Scheduling and Appointment Booking System – Bookly to version 14.6 or newer.
Official ID
CVE-2018-6891
Report title
WordPress Online Booking and Scheduling Plugin – Bookly <= 14.5 - Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)