CVE-2026-13424

The Bookly plugin for WordPress, in versions up to 27.7, has a security flaw that allows attackers to inject malicious code into a website. This is due to inadequate protection against tainted input, which allows attackers to inject arbitrary scripts that will run when a user visits a specific page. The vulnerability is triggered through an AJAX action that can be accessed without authentication, and the malicious code is stored in the website's logs, where it can be executed by an administrator when they view the logs.

Based on public CVE data (MITRE/NVD).