# Bookly vulnerabilities Source: https://junglewise.ai/threats/vendors/bookly Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/bookly.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in Bookly: 0 in the last 7 days and 10 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-12626, was published on 10 October 2026. Nothing in the last four weeks, down from 10 vulnerabilities in the four before. 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 10 - All time: 15 (2 critical, 0 exploited in the wild) ## About Bookly Developer of automated booking and scheduling software for WordPress. ## Latest Bookly vulnerabilities - [CVE-2026-12626: Bookly plugin for WordPress PHP Object Injection](https://junglewise.ai/threats/cve-2026-12626-the-online-scheduling-and-appointment-booking-system-bookly) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-104898: Bookly insecure direct object reference in staff account binding](https://junglewise.ai/threats/cve-2026-104898-the-online-scheduling-and-appointment-booking-system-bookly) (medium, CVSS 6.8, published 10 Oct 2026) - [CVE-2026-103365: Bookly Online Scheduling sensitive information exposure](https://junglewise.ai/threats/cve-2026-103365-the-bookly-online-scheduling-and-appointment-booking-system) (medium, CVSS 5.3, published 10 Oct 2026) - [CVE-2026-96348: Bookly broken access control in appointment booking](https://junglewise.ai/threats/cve-2026-96348-unauthenticated-broken-access-control-in-bookly-28-2-versions) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-96347: Bookly Insecure Direct Object References (IDOR) in Subscriber access](https://junglewise.ai/threats/cve-2026-96347-subscriber-insecure-direct-object-references-idor-in-bookly-28-2) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-86838: Bookly WordPress plugin payment bypass via booking price manipulation](https://junglewise.ai/threats/cve-2026-86838-the-bookly-wordpress-plugin-before-28-3-does-not-validate-client) (medium, CVSS 5.3, published 28 Sep 2026) - [CVE-2026-86841: Bookly plugin PHP object injection in diagnostics](https://junglewise.ai/threats/cve-2026-86841-the-online-scheduling-and-appointment-booking-system-wordpress) (info, published 27 Sep 2026) - [CVE-2026-93399: Bookly Insecure Direct Object Reference in AJAX handlers](https://junglewise.ai/threats/cve-2026-93399-the-bookly-plugin-for-wordpress-is-vulnerable-to-insecure-direct) (critical, CVSS 9.1, published 25 Sep 2026) - [CVE-2026-91847: Bookly appointment booking plugin IDOR in AI assistant conversations](https://junglewise.ai/threats/cve-2026-91847-the-online-scheduling-and-appointment-booking-system-wordpress) (medium, CVSS 4.8, published 19 Sep 2026) - [CVE-2026-89063: WordPress Bookly plugin insecure direct object reference in AI conversations](https://junglewise.ai/threats/cve-2026-89063-wordpress-bookly-plugin-insecure-direct-object-reference-in-ai) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-13395: Bookly Online Scheduling and Appointment Booking System SQL injection in staff_id](https://junglewise.ai/threats/cve-2026-13395-bookly-online-scheduling-and-appointment-booking-system-sql) (info, CVSS 8.6, published 30 Jul 2026) - [CVE-2026-61949: Bookly SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-61949-bookly-sql-injection-in-wordpress-plugin) (critical, CVSS 9.3, published 23 Jul 2026) - [CVE-2026-61944: Bookly WordPress plugin unauthenticated XSS](https://junglewise.ai/threats/cve-2026-61944-bookly-wordpress-plugin-unauthenticated-xss) (high, CVSS 7.1, published 23 Jul 2026) - [CVE-2026-42667: Bookly WordPress plugin sensitive data exposure](https://junglewise.ai/threats/cve-2026-42667-bookly-wordpress-plugin-sensitive-data-exposure) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-5513: Bookly WordPress Plugin Stored XSS in bookly-customer-full-name cookie](https://junglewise.ai/threats/cve-2026-5513-bookly-wordpress-plugin-stored-xss-in-bookly-customer-full-name) (high, CVSS 7.2, published 13 Jun 2026) ## Most severe Bookly vulnerabilities - [CVE-2026-61949: Bookly SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-61949-bookly-sql-injection-in-wordpress-plugin) (critical, CVSS 9.3, published 23 Jul 2026) - [CVE-2026-93399: Bookly Insecure Direct Object Reference in AJAX handlers](https://junglewise.ai/threats/cve-2026-93399-the-bookly-plugin-for-wordpress-is-vulnerable-to-insecure-direct) (critical, CVSS 9.1, published 25 Sep 2026) - [CVE-2026-89063: WordPress Bookly plugin insecure direct object reference in AI conversations](https://junglewise.ai/threats/cve-2026-89063-wordpress-bookly-plugin-insecure-direct-object-reference-in-ai) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-96348: Bookly broken access control in appointment booking](https://junglewise.ai/threats/cve-2026-96348-unauthenticated-broken-access-control-in-bookly-28-2-versions) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-42667: Bookly WordPress plugin sensitive data exposure](https://junglewise.ai/threats/cve-2026-42667-bookly-wordpress-plugin-sensitive-data-exposure) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-12626: Bookly plugin for WordPress PHP Object Injection](https://junglewise.ai/threats/cve-2026-12626-the-online-scheduling-and-appointment-booking-system-bookly) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-5513: Bookly WordPress Plugin Stored XSS in bookly-customer-full-name cookie](https://junglewise.ai/threats/cve-2026-5513-bookly-wordpress-plugin-stored-xss-in-bookly-customer-full-name) (high, CVSS 7.2, published 13 Jun 2026) - [CVE-2026-61944: Bookly WordPress plugin unauthenticated XSS](https://junglewise.ai/threats/cve-2026-61944-bookly-wordpress-plugin-unauthenticated-xss) (high, CVSS 7.1, published 23 Jul 2026) - [CVE-2026-104898: Bookly insecure direct object reference in staff account binding](https://junglewise.ai/threats/cve-2026-104898-the-online-scheduling-and-appointment-booking-system-bookly) (medium, CVSS 6.8, published 10 Oct 2026) - [CVE-2026-96347: Bookly Insecure Direct Object References (IDOR) in Subscriber access](https://junglewise.ai/threats/cve-2026-96347-subscriber-insecure-direct-object-references-idor-in-bookly-28-2) (medium, CVSS 6.5, published 30 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 10 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 2 | 1 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Bookly technologies - [Bookly](https://junglewise.ai/threats/technologies/bookly): 12 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Bookly vulnerabilities", https://junglewise.ai/threats/vendors/bookly, 10 November 2026.