ladela

6 results · Clear filters · Feed

• High 7.2
  CVE-2026-12626

  Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter

  The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for au…

  ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  Oct 10, 2026
• High 7.5
  CVE-2026-89063 Scanner template

  Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter

  The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled …

  ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  Sep 16, 2026
• High 7.2
  CVE-2026-13424

  Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action

  The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and…

  ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  Aug 16, 2026
• High 7.5
  CVE-2026-14516

  Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection

  The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter a…

  ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  Jul 28, 2026
• High 7.2
  CVE-2026-5513 Public exploit

  Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

  The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output…

  ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  Jun 13, 2026
• High 7.2
  CVE-2023-1172

  The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to,…

  ladela WordPress Online Booking and Scheduling Plugin – Bookly Web / CMS
  Mar 17, 2023