What is the CVSS score of CVE-2026-61944?

CVE-2026-61944 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Bookly are affected by CVE-2026-61944?

Bookly, a widely-deployed WordPress appointment-booking plugin, contains a vulnerability in versions 27.7 and earlier that allows unauthenticated attackers to inject malicious code into booking pages…

How to fix or mitigate CVE-2026-61944?

Within 24 hours: Conduct a complete inventory of WordPress installations running Bookly using plugin management tools or automated scanning, and document all instances at version 27.7 or earlier. Within 7 days: Deploy Web Application Firewall (WAF) rules to block script injection patterns in booking form inputs, implement Content Security Policy (CSP) headers to prevent inline script execution, and review booking-related access logs for exploitation attempts. Within 30 days: Monitor Bookly vendor security advisories for patch availability; if no patch is released within 60 days or risk tolerance does not permit WAF-only protection, evaluate migration to alternative appointment-booking solutions or implement additional containment by running Bookly on an isolated subdomain with restricted session cookies.

Bookly CVE-2026-61944

EUVD-2026-48203 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-jr85-9r26-h3c6

WordPress XSS Bookly Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (AV:N/PR:N) needing victim click (UI:R); scope changes to browser origin (S:C) with limited C/I/A, matching a reflected/stored XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:41 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

AnalysisAI

Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.

Technical ContextAI

Bookly is a widely used WordPress plugin providing online appointment scheduling and booking forms, typically exposed on public-facing pages of service businesses. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input reaching a booking or form-handling parameter is rendered back into an HTML/JS context without adequate output encoding or input sanitization. The affected CPE cpe:2.3:a:bookly:bookly:*:*:*:*:*:*:*:* covers all versions up to and including 27.7. The CVSS scope change (S:C) indicates the vulnerable component (the plugin) and the impacted component (the visitor's browser within the WordPress site origin) differ, which is characteristic of XSS where script executes under the site's origin and can reach cookies, DOM, and authenticated admin sessions.

RemediationAI

Patch available per vendor advisory - upgrade Bookly to the latest release above 27.7 as published on the WordPress plugin repository and referenced by Patchstack (https://patchstack.com/database/wordpress/plugin/bookly-responsive-appointment-booking-tool/vulnerability/wordpress-bookly-plugin-27-7-cross-site-scripting-xss-vulnerability); the exact fixed version is not confirmed in the available data, so verify against the vendor changelog before deploying. If immediate upgrade is not possible, deploy a WAF or virtual-patch rule (Patchstack and similar platforms offer one) to filter script/HTML metacharacters on the plugin's booking form parameters, and restrict or add CAPTCHA/authentication to public booking endpoints to reduce untrusted input reaching the vulnerable sink - with the trade-off that CAPTCHA and access restrictions can reduce legitimate booking conversions. A restrictive Content-Security-Policy that disallows inline script execution also limits payload impact but may break plugin functionality that relies on inline scripts and must be tested.