What is the CVSS score of CVE-2026-32540?

CVE-2026-32540 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Bookly are affected by CVE-2026-32540?

CVE-2026-32540 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-32540?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Bookly CVE-2026-32540

EUVD-2026-15915 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-9vgf-wj9v-g7gw

XSS Bookly

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15915

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through <= 26.7.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Bookly, a WordPress appointment booking plugin, affecting versions up to and including 26.7. Attackers can inject malicious scripts into web requests that execute in the victim's browser when the vulnerable page is rendered, allowing session hijacking, credential theft, or malware distribution. While no CVSS score or EPSS data is currently available, the vulnerability has been formally tracked by ENISA (EUVD-2026-15915) and reported via Patchstack, indicating active awareness in the security community.

Technical ContextAI

The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Bookly is a WordPress plugin (CPE: cpe:2.3:a:bookly:bookly:*:*:*:*:*:*:*:*) that handles appointment booking functionality and likely processes user input through query parameters or form data without adequate HTML entity encoding or Content Security Policy protections. Reflected XSS occurs when untrusted input is echoed back in the HTTP response without sanitization, allowing attackers to craft malicious URLs that bypass same-origin restrictions and execute arbitrary JavaScript in the victim's security context.

RemediationAI

Upgrade Bookly to a version newer than 26.7 immediately. Check the official Bookly plugin repository or vendor advisory at https://patchstack.com/database/Wordpress/Plugin/bookly-responsive-appointment-booking-tool/ for the patched release. Until a patch is deployed, implement defensive measures including: enable WordPress security plugins that provide input validation and output encoding, enforce Content Security Policy (CSP) headers to restrict script execution, apply Web Application Firewall (WAF) rules to detect and block XSS payloads in query parameters, and educate users not to click suspicious links referencing your Bookly booking pages. Consider temporarily disabling Bookly if it is not critical to business operations pending patch availability.