Is Online Scheduling and Appointment Booking System safe?

Every recorded flaw

• Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: PHP Object InjectionCVE-2026-12626 · affects up to 28.2 · reported by WordfenceHigh 7.2
• Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: Insecure Direct Object ReferenceCVE-2026-104898 · affects up to 28.4 · reported by WordfenceMedium 6.8
• Oct 10, 2026Bookly – Online Scheduling and Appointment Booking System: Sensitive Information ExposureCVE-2026-103365 · affects up to 28.4 · reported by WordfenceMedium 5.3
• Sep 30, 2026Unauthenticated Broken Access Control in Bookly <= 28.2 versions.CVE-2026-96348 · affects up to 28.2 · reported by PatchstackHigh 7.5
• Sep 30, 2026Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.CVE-2026-96347 · affects up to 28.2 · reported by PatchstackMedium 6.5
• Sep 28, 2026Bookly: Does not validate client-supplied booking quantity values on the server before computing the appointment totalCVE-2026-86838 · fixed in 28.3 · reported by WPScanMedium 5.3
• Sep 27, 2026Online Scheduling and Appointment Booking System: Does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administratorsCVE-2026-86841 · fixed in 28.3 · reported by WPScanMedium 4.7
• Sep 27, 2026Online Scheduling and Appointment Booking System: Does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff memberCVE-2026-86839 · fixed in 28.3 · reported by WPScanLow 3.8
• Sep 25, 2026Bookly: Does not properly verify a customer's identity before updating their stored detailsCVE-2026-86837 · fixed in 28.3 · reported by WPScanMedium 5.3
• Sep 25, 2026Bookly: Insecure Direct Object ReferenceCVE-2026-93399 · affects up to 28.2 · reported by WordfenceCritical 9.1
• Sep 25, 2026Online Scheduling and Appointment Booking System – Bookly: Authorization BypassCVE-2026-92799 · affects up to 28.2 · reported by WordfenceMedium 5.3
• Sep 19, 2026Online Scheduling and Appointment Booking System: Does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actionsCVE-2026-91847 · fixed in 28.2 · reported by WPScanMedium 4.8
• Sep 16, 2026Online Scheduling and Appointment Booking System – Bookly: Insecure Direct Object ReferenceCVE-2026-89063 · affects up to 28.1 · reported by Wordfence1.6% oddsHigh 7.5
• Sep 8, 2026Online Scheduling and Appointment Booking System – Bookly: Unauthorized modification of dataCVE-2026-2520 · affects up to 27.2 · reported by WordfenceMedium 5.4
• Aug 16, 2026Online Scheduling and Appointment Booking System – Bookly: Stored Cross-Site ScriptingCVE-2026-13424 · affects up to 27.7 · reported by WordfenceHigh 7.2
• Aug 16, 2026Bookly: Insecure Direct Object ReferenceCVE-2026-12905 · affects up to 27.7 · reported by WordfenceMedium 4.3
• Jul 30, 2026Online Scheduling and Appointment Booking System: Does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL queryCVE-2026-13395 · fixed in 27.8 · reported by WPScanHigh 8.6
• Jul 28, 2026Online Scheduling and Appointment Booking System – Bookly: Time-based SQL InjectionCVE-2026-14516 · affects up to 27.5 · reported by WordfenceHigh 7.5
• Jul 23, 2026Unauthenticated SQL Injection in Bookly <= 27.7 versions.CVE-2026-61949 · affects up to 27.7 · reported by PatchstackCritical 9.3
• Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.CVE-2026-61944 · affects up to 27.7 · reported by PatchstackHigh 7.1
• Jun 15, 2026Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.CVE-2026-42667 · affects up to 27.4 · reported by PatchstackHigh 7.5
• Jun 13, 2026Online Scheduling and Appointment Booking System – Bookly: Stored Cross-Site ScriptingCVE-2026-5513 · affects up to 27.2 · reported by WordfenceHigh 7.2
• Apr 9, 2026Online Scheduling and Appointment Booking System – Bookly: Price manipulationCVE-2026-2519 · affects up to 27.0 · reported by WordfenceMedium 5.3
• Mar 25, 2026Bookly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32540 · affects up to 26.7 · reported by PatchstackHigh 7.1
• Jun 11, 2024WordPress Online Booking and Scheduling Plugin – Bookly: Stored Cross-Site ScriptingCVE-2024-5584 · affects up to 23.2 · reported by WordfenceMedium 6.4
• May 17, 2024Bookly: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-26526 · affects up to 21.7.1 · reported by PatchstackHigh 7.7
• Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · fixed in 22.5 · reported by WPScanMedium 4.8
• Oct 16, 2023WordPress Online Booking and Scheduling: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-4691 · fixed in 22.4 · reported by WPScanHigh 7.2
• Jun 2, 2023Bookly: Stored Cross-Site ScriptingCVE-2023-1159 · affects up to 21.5 · reported by WordfenceMedium 4
• Mar 17, 2023Bookly: Stored Cross-Site ScriptingCVE-2023-1172 · affects up to 21.5 · reported by WordfenceHigh 7.2
• Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · fixed in 20.3.1 · reported by WPScanMedium 5.4
• Feb 11, 2018Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-6891 · fixed in 14.5 · reported by MITREMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.