Skip to content
OpenAdvisories

Vendor

ladela

15 known vulnerabilities.

Products

Online Scheduling and Appointment Booking System – Bookly 13 WordPress Online Booking and Scheduling Plugin – Bookly 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-93399 Public exploit

    Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

    The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to …

    ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS