Vulnerability history

Unauthenticated Payment Bypass vulnerability

Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability

Bookly Administrator+ PHP Object Injection vulnerability

Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion vulnerability

Unauthenticated Authorization Bypass vulnerability

Unauthenticated Customer PII Update vulnerability

Insecure Direct Object References (IDOR) vulnerability

Broken Access Control vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability

Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability

WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability

Unauthenticated SQL Injection vulnerability

SQL Injection vulnerability

SQL Injection vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Sensitive Data Exposure vulnerability

WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.0 - Unauthenticated Price Manipulation via 'tips' vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter vulnerability

Admin+ SQLi vulnerability

Admin+ Stored Cross-Site Scripting via service titles vulnerability

Authenticated Arbitrary File Deletion vulnerability

Unauthenticated Stored Cross-Site Scripting via Name vulnerability

Stored Cross-Site Scripting (XSS) vulnerability

Unauth. Stored Cross-Site Scripting (XSS) vulnerability