CVE-2026-13424
High · CVSS 7.2Published 2026-08-16
CVSS
7.2
High
EPSS
0.3%
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-13424?
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection point is the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_* and therefore reachable without authentication; the payload is stored verbatim in the bookly_log.details column when a request is submitted without a valid signature, and executes when an administrator later views the Diagnostics → Logs page.
CVSS Score Explained
CVSS 7.2 is High severity. Exploitation is likely straightforward and the impact is significant — data loss, privilege escalation, or remote code execution are common outcomes. Patch as soon as possible.
EPSS Exploitation Probability
EPSS 0.3% — low probability of active exploitation. Can be handled in normal patch cycles.
References & Patches
- ›https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/backend/modules/diagnostics/Ajax.php#L344
- ›https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/backend/modules/diagnostics/resources/js/diagnostics.js#L542
- PATCHhttps://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/lib/PluginsUpdater.php#L13
- PATCHhttps://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/lib/PluginsUpdater.php#L97
- ›https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/backend/modules/diagnostics/Ajax.php#L344
- ›https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/backend/modules/diagnostics/resources/js/diagnostics.js#L542
- PATCHhttps://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/lib/PluginsUpdater.php#L13
- PATCHhttps://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/lib/PluginsUpdater.php#L97
- ›https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool
- ›https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb53e44-7f9d-490f-b938-f428c20219d7?source=cve
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-19961A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.8.6
- CVE-2026-19958A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.2.1
- CVE-2026-19959A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.8.6
- CVE-2026-19960A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.2.1
- CVE-2026-19957A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.2.1
- CVE-2026-19956A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue.5.3