Executive brief
The Bookly plugin for WordPress, which manages online scheduling and appointments, contains a security flaw that allows attackers to inject malicious scripts into the website. This occurs through a specific cookie used to store customer names, potentially leading to unauthorized actions or data theft when other users visit the site. The risk is present only if the 'Remember personal information in cookies' setting is manually enabled.
Technical details
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the 'bookly-customer-full-name' cookie. An unauthenticated attacker can manipulate this cookie value to include arbitrary web scripts. These scripts are then stored and executed in the browser of any user who accesses a page where the customer name is displayed. This vulnerability requires the 'Remember personal information in cookies' setting to be enabled, which is disabled by default. A fix is available in versions following 27.2.
Affected products
- Bookly Bookly plugin for WordPress up to, and including, 27.2
Timeline
- 2026-06-13: disclosed
- 2026-06-13: advisory