Bookly
Bookly
Developer
28.6
Latest version
60,000
Installations
No date
Last updated
Vulnerability history
0 present
28 patched
12 Mitigation rules
- Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation vulnerability<= 28.409/10/2026
- Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details vulnerability<= 28.409/10/2026
- Unauthenticated Payment Bypass vulnerability< 28.328/09/2026
- Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability< 28.327/09/2026
- Bookly Administrator+ PHP Object Injection vulnerability23.2-28.227/09/2026
- Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion vulnerability<= 28.225/09/2026
- Unauthenticated Authorization Bypass vulnerability<= 28.225/09/2026
- Unauthenticated Customer PII Update vulnerability< 28.325/09/2026
- Insecure Direct Object References (IDOR) vulnerability<= 28.224/09/2026
- Broken Access Control vulnerability<= 28.224/09/2026
- Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability<= 28.115/09/2026
- Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability<= 27.207/09/2026
- WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability<= 27.718/08/2026
- Unauthenticated SQL Injection vulnerability< 27.803/08/2026
- SQL Injection vulnerability<= 27.730/07/2026
- SQL Injection vulnerability<= 27.716/07/2026
- Cross Site Scripting (XSS) vulnerability<= 27.716/07/2026
- Unauthenticated Stored Cross-Site Scripting vulnerability<= 27.215/06/2026
- Sensitive Data Exposure vulnerability<= 27.410/05/2026
- WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.0 - Unauthenticated Price Manipulation via 'tips' vulnerability<= 27.009/04/2026
- Reflected Cross Site Scripting (XSS) vulnerability<= 26.720/03/2026
- Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter vulnerability<= 23.211/06/2024
- Admin+ SQLi vulnerability< 22.417/10/2023
- Admin+ Stored Cross-Site Scripting via service titles vulnerability< 21.822/06/2023
- Authenticated Arbitrary File Deletion vulnerability<= 21.7.111/05/2023
- Unauthenticated Stored Cross-Site Scripting via Name vulnerability<= 21.520/03/2023
- Stored Cross-Site Scripting (XSS) vulnerability<= 20.308/11/2021
- Unauth. Stored Cross-Site Scripting (XSS) vulnerability<= 14.410/02/2018