Skip to content
OpenAdvisories

Vendor

ladela

15 known vulnerabilities.

Products

Online Scheduling and Appointment Booking System – Bookly 13 WordPress Online Booking and Scheduling Plugin – Bookly 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-93399 Public exploit

    Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

    The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to …

    ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  • High 7.2
    CVE-2026-5513 Public exploit

    Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

    The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output…

    ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS