EUVD-2026-59927
GHSA-q2ch-2q4j-vq6h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R applied because stored payload execution requires an administrator to actively navigate to the Diagnostics Logs page; all other metrics match the unauthenticated network-accessible injection and changed-scope admin browser execution context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Online Scheduling and Appointment Booking System - Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection point is the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_* and therefore reachable without authentication; the payload is stored verbatim in the bookly_log.details column when a request is submitted without a valid signature, and executes when an administrator later views the Diagnostics → Logs page.
AnalysisAI
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Technical ContextAI
The Bookly plugin (CPE: cpe:2.3:a:ladela:online_scheduling_and_appointment_booking_system_-_bookly:*:*:*:*:*:*:*:*) by Ladela is a WordPress appointment scheduling and management tool. WordPress AJAX actions registered under the wp_ajax_nopriv_* hook prefix are accessible to unauthenticated HTTP clients via wp-admin/admin-ajax.php without any session or nonce validation at the routing layer. The vulnerable handler, bookly_speed_up_update_addons, is implemented in lib/PluginsUpdater.php (lines 13 and 97 per Wordfence SVN references at tags 27.5 and 27.7): when a request arrives without a valid signature, the plugin's error-handling branch logs raw request-supplied data directly to the bookly_log.details database column with neither input sanitization nor parameterized escaping. That stored value is later retrieved and rendered without output escaping in the Diagnostics → Logs admin view, implemented in backend/modules/diagnostics/Ajax.php (line 344) and the accompanying diagnostics.js (line 542). CWE-79 - Improper Neutralization of Input During Web Page Generation - is the root cause: attacker-controlled data flows from an unauthenticated HTTP request through persistent storage into an HTML rendering context without sanitization at either the ingestion or the output stage, representing a classic stored-XSS data-flow failure.
RemediationAI
Update the Bookly plugin to the version immediately following 27.7; verify the exact patched release number against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb53e44-7f9d-490f-b938-f428c20219d7 and the upstream SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool, as the exact first-fixed version is not independently confirmed from available data. If an immediate update is not feasible, disabling the Bookly plugin eliminates the vulnerable endpoint entirely at the cost of all booking functionality. As a narrower compensating control, deploying a WAF rule to block unauthenticated POST requests to wp-admin/admin-ajax.php with action=bookly_speed_up_update_addons prevents the injection step without requiring a plugin change, though this may interfere with legitimate addon update workflows if they share this action name. Restricting access to the Diagnostics → Logs admin page via role-based access controls limits payload execution surface but does not prevent payloads from being written to the database, leaving residual risk if controls change. Patch availability per SVN changeset is the only confirmed remediation path; no vendor-released versioned patch has been independently verified from the available data.
Stored cross-site scripting in the Bookly Online Scheduling and Appointment Booking System plugin for WordPress (version
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows an
Price manipulation in Bookly WordPress plugin (versions up to 27.0) allows unauthenticated attackers to reduce appointme
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today