¿Es seguro Bookly Responsive Appointment Booking Tool?

Qué hace este plugin

• Slug: bookly-responsive-appointment-booking-tool
• 60000+ instalaciones activas

appointment bookingappointmentsbookingbooking calendarbooking system

Estado de mantenimiento

• Última versión conocida: 27.8
• Requiere PHP: 5.3.7+
• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

12 CVEs conocidos registrados para Bookly Responsive Appointment Booking Tool.

CVE-2026-5513

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires 'Remember personal information in cookies' setting to be enabled (disabled by default).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-42667

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 27.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-32540

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 26.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-5584

The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the staff member role and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-5209

The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 22.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-4691

The Bookly plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 22.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-1159

The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-26526

No patched version is available. No reply from the vendor. Rafie Muhammad (Patchstack) discovered and reported this Arbitrary File Deletion vulnerability in WordPress Bookly Plugin. This could allow a malicious actor to delete files from your website. If core files are deleted from your website, it could cause your site to break and stop functioning. This vulnerability has not been known to be fixed yet.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 4 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-1172	Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 21.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 21.6	21.6	2023-03-17	✓ corregido en la última versión
CVE-2021-24930	Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 20.3.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 20.3.1	20.3.1	2021-11-08	✓ corregido en la última versión
CVE-2018-6891	Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 14.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 14.6	14.6	2018-02-10	✓ corregido en la última versión
CVE-2026-2519	Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 27.1	—	Desconocido	< 27.1	27.1	0000-00-00	✓ corregido en la última versión

CVE-2023-1172

Update the WordPress Bookly plugin to the latest available version (at least 21.5.1). Vinay Kumar discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Bookly Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 21.5.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-24930

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2018-6891

Update the WordPress Bookly plugin to the latest available version (at least 14.5). Luigi discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Bookly Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 14.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2026-2519

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Bookly Responsive Appointment Booking Tool actualizado — 27.8 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — 100000+ instalaciones activas — 98/100 (91) — PHP máx. 8.4
• Booking for Appointments and Events Calendar – Amelia — 90000+ instalaciones activas — 92/100 (774)
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin — 60000+ instalaciones activas — 100/100 (155) — PHP máx. 8.4
• Booking Calendar — 50000+ instalaciones activas — 94/100 (652) — PHP máx. 8.4
• SimplyBook.me – Booking and reservations calendar — 30000+ instalaciones activas — 90/100 (17) — PHP máx. 8.4