CVE-2026-13424

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 27.8

Description The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the bookly speed up update addons AJAX action. The payload is stored in the bookly log.details column when a request is submitted without a valid signature. The script executes when an administrator views the Diagnostics → Logs page.

Recommendations Update the plugin to a version newer than 27.7. As a temporary mitigation, restrict access to the Diagnostics → Logs page to minimize the risk of script execution.