TI-2026-44321 CVE-2026-61949 · GHSA-frmr-fpp8-95g2
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
Priority MEDIUM 46
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
Bookly
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Bookly records in CISA KEVNo Bookly vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-30926 CVE-2026-42667 · GHSA-cg3x-gr84-9cpm
WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability
Priority LOW 39
Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.
TI-2026-63761 CVE-2026-96348 · GHSA-qch3-qqf9-hcfw
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Priority LOW 38
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
TI-2026-44316 CVE-2026-61944 · GHSA-jr85-9r26-h3c6
WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability
Priority LOW 31
Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
TI-2026-25068 CVE-2026-32540 · GHSA-9vgf-wj9v-g7gw
WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability
Priority LOW 30
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a thro…
TI-2026-63760 CVE-2026-96347 · GHSA-qcxf-4p83-2pfq
WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability
Priority LOW 29
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.