CVE Intelligence

Bookly vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Bookly products: 4 record(s), with severity, exploitation and fixes.

Bookly 4

Exploited only (KEV) →

CVE-2026-61949 Critical · 9.3 CWE-89 Jul 23, 2026
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
CVE-2026-61944 High · 7.1 CWE-79 Jul 23, 2026
WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
CVE-2026-42667 High · 7.5 CWE-201 Jun 15, 2026
WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.
CVE-2026-32540 High · 7.1 CWE-79 Mar 25, 2026
WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through <= 26.7.