Skip to content
OpenAdvisories
Critical · 9.3 CVE-2026-61949 EUVD-2026-48207GHSA-frmr-fpp8-95g2

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Published Jul 23, 2026 · Updated Nov 10, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Blind SQL Injection.This issue affects Bookly: from n/a through 27.7.

Affected products

VendorProductAffectedFixed
Bookly Bookly ≤ 27.7 —

References