What is the CVSS score of CVE-2026-13424?

CVE-2026-13424 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Bookly are affected by CVE-2026-13424?

The Bookly WordPress appointment scheduling plugin (versions ≤27.7) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts into…

How to fix or mitigate CVE-2026-13424?

Within 24 hours, inventory all WordPress installations using Bookly and document the installed version to determine exposure scope. Within 7 days, implement interim controls: disable the vulnerable wp_ajax_nopriv_bookly_speed_up_update_addons AJAX endpoint via Web Application Firewall rules or .htaccess restrictions, restrict WordPress admin panel access by IP address where feasible, and engage the plugin evaluation team to identify and plan migration to an alternative scheduling solution. Within 30 days, monitor Bookly's security advisory channels for patch releases; if a patch becomes available, validate it in a test environment and plan a staged upgrade to the patched version, or proceed with migration to a replacement plugin with demonstrated active security maintenance.

Bookly CVE-2026-13424

EUVD-2026-59927 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-q2ch-2q4j-vq6h

WordPress XSS Online Scheduling And Appointment Booking System Bookly Wordpress Plugin Ladela

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

UI:R applied because stored payload execution requires an administrator to actively navigate to the Diagnostics Logs page; all other metrics match the unauthenticated network-accessible injection and changed-scope admin browser execution context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 07:23 vuln.today

CVE Published

Aug 16, 2026 - 06:38 nvd

HIGH 7.2

DescriptionCVE.org

The Online Scheduling and Appointment Booking System - Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection point is the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_* and therefore reachable without authentication; the payload is stored verbatim in the bookly_log.details column when a request is submitted without a valid signature, and executes when an administrator later views the Diagnostics → Logs page.

AnalysisAI

Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The Bookly plugin must be installed and active on the target WordPress site running version 27.7 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.2 is driven by a network-accessible, low-complexity, unauthenticated vector with changed scope - metrics that accurately characterize the injection phase. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Bookly plugin to the version immediately following 27.7; verify the exact patched release number against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb53e44-7f9d-490f-b938-f428c20219d7 and the upstream SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool, as the exact first-fixed version is not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report.