These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. Authenticated attackers with custom-level access and above can inject a PHP Object. No known gadget chain is available. This vulnerability allows attackers to potentially execute [truncated]
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference. Authenticated attackers with subscriber-level access can overwrite WordPress account bindings of Bookly staff records, potentially escalating privileges. This vulnerability exists in all versions up to, and including, 28.4 of the Bookly plugin. Exploitation requires the att [truncated]
CVE-2026-103365: The Online Scheduling and Appointment Booking System plugin for WordPress, versions up to and including 28.4, is vulnerable to Sensitive Information Exposure. This vulnerability allows unauthenticated attackers to access customer data, including names, emails, phones, and internal notes, via the bookly_render_details endpoint. The endpoint is registered for both wp_ajax and wp_ajax_nopriv [truncated]
The Bookly plugin for WordPress has a critical vulnerability, CVE-2026-93399, with a CVSS score of 9.1. This Insecure Direct Object Reference vulnerability affects versions up to and including 28.2. It allows unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This vulnerability allows unauthenticated attackers to bypass the phone/email ownership verification step and overwrite customer records. The vulnerability is caused by the `postValidateCustomer()` function using a loose [truncated]
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses a [truncated]