Online Scheduling And Appointment Booking System – Bookly
Approved changes feed: RSS · Atom
cpe:2.3:a:ladela:online_scheduling_and_appointment_booking_system_–_bookly:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Ladela (a6464665-83bd-5bd2-bc39-fceabb48c807) |
|---|---|
| Product | Online Scheduling And Appointment Booking System – Bookly (6b108a3a-e5ce-51d5-91d4-33536e481df0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-2520 |
vulnerable | 2026-09-16 04:33:25.704004 |
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
MEDIUM (5.4)
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
Published: 2026-09-08T11:30:01.269Z
Updated: 2026-09-08T12:01:15.828Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5513 |
vulnerable | 2026-07-29 01:03:18.894589 |
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
HIGH (7.2)
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires 'Remember personal information in cookies' setting to be enabled (disabled by default).
Published: 2026-06-13T11:25:24.786Z
Updated: 2026-06-15T10:39:09.228Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2519 |
vulnerable | 2026-06-08 07:55:17.166968 |
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
MEDIUM (5.3)
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.
Published: 2026-04-09T12:28:06.471Z
Updated: 2026-04-13T15:15:09.493Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5584 |
vulnerable | 2026-06-08 06:56:16.616340 |
WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
MEDIUM (6.4)
The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the staff member role and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-06-11T09:32:02.511Z
Updated: 2026-04-08T16:47:06.483Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.