CVE-2026-5513: Bookly WordPress Plugin XSS Vulnerability

CVE-2026-5513 Overview

CVE-2026-5513 is a Stored Cross-Site Scripting (XSS) vulnerability in the Online Scheduling and Appointment Booking System – Bookly plugin for WordPress. The flaw affects all versions up to and including 27.2. Unauthenticated attackers can inject arbitrary JavaScript through the bookly-customer-full-name cookie due to insufficient input sanitization and output escaping [CWE-79]. Injected scripts execute in the browser of any user who visits an affected page. Exploitation requires the plugin's Remember personal information in cookies setting to be enabled, which is disabled by default.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in visitor browsers, enabling session theft, credential harvesting, and administrative account takeover when an admin views injected content.

Affected Products

WordPress
Bookly – Online Scheduling and Appointment Booking System plugin
Bookly plugin versions up to and including 27.2

Discovery Timeline

2026-06-13 - CVE-2026-5513 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-5513

Vulnerability Analysis

The Bookly plugin processes the bookly-customer-full-name cookie value and renders it into HTML output without applying adequate sanitization or escaping. When an attacker controls the cookie content, supplied script payloads persist in the rendered page and execute in the browser context of every visitor who loads that page. Because the cookie can be set client-side, no authentication is needed to plant the payload.

The scope-changed nature of the issue means injected scripts can affect content outside the vulnerable component, including administrator sessions. Successful exploitation enables session token theft, forced administrative actions through the WordPress REST API, redirection to attacker-controlled infrastructure, and delivery of follow-on payloads to site visitors.

Root Cause

The plugin fails to apply WordPress sanitization functions such as sanitize_text_field() on cookie input and omits output escaping helpers such as esc_html() or esc_attr() when rendering the customer name. Cookie data is treated as trusted user-profile input rather than attacker-controllable data, producing a classic stored XSS condition rooted in CWE-79.

Attack Vector

An attacker sets the bookly-customer-full-name cookie to a value containing JavaScript, then triggers a booking workflow that causes the plugin to persist or render the cookie value. When subsequent visitors, including site administrators, load the affected page, the malicious script executes in their browsers. The attack requires no privileges and no user interaction beyond visiting the page. Exploitation is only viable when the site operator has enabled the optional Remember personal information in cookies setting.

No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-5513

Indicators of Compromise

HTTP requests containing a bookly-customer-full-name cookie value with HTML tags, <script> markers, or JavaScript event handlers such as onerror= and onload=.
Unexpected outbound requests from administrator browsers to unfamiliar domains immediately after accessing Bookly booking pages.
New or modified WordPress administrator accounts, plugins, or theme files following visits to compromised booking pages.
Bookly plugin reporting Remember personal information in cookies enabled on installations running version 27.2 or earlier.

Detection Strategies

Inspect web server access logs and WAF telemetry for cookie headers containing URL-encoded <, >, script, or common XSS payload patterns targeting bookly-customer-full-name.
Run authenticated vulnerability scans against WordPress sites to flag Bookly installations at version 27.2 or earlier.
Review the WordPress database for stored customer-name fields containing HTML or JavaScript content.

Monitoring Recommendations

Forward WordPress, web server, and WAF logs to a centralized analytics platform for correlation of cookie-based injection attempts with downstream administrator activity.
Alert on JavaScript execution anomalies in administrator sessions, including unexpected XHR or fetch calls to the WordPress REST API.
Track plugin inventory and version drift across WordPress estates to identify hosts still running vulnerable Bookly releases.

How to Mitigate CVE-2026-5513

Immediate Actions Required

Update the Bookly plugin to the version released after 27.2 that includes the fix referenced in the WordPress plugin changeset 3504922.
Disable the Remember personal information in cookies setting in Bookly until patching is complete.
Audit administrator accounts, scheduled tasks, and plugin files for unauthorized changes that may indicate prior exploitation.
Force password resets and invalidate active sessions for WordPress administrators on affected sites.

Patch Information

The vendor addressed the issue in the changeset published at WordPress Plugin Changeset 3504922. Apply the latest Bookly release from the WordPress plugin repository to remediate the vulnerability. Refer to the Wordfence Vulnerability Report for the fixed version and additional remediation guidance.

Workarounds

Keep the Remember personal information in cookies setting disabled, which is the default configuration.
Deploy a Web Application Firewall rule that blocks requests containing HTML or script content in the bookly-customer-full-name cookie.
Apply a strict Content Security Policy that disallows inline script execution to reduce the impact of any stored payloads.
Restrict administrator access to booking pages until the plugin is patched.

bash

# Example WAF rule pattern (ModSecurity) to block script content in the vulnerable cookie
SecRule REQUEST_COOKIES:bookly-customer-full-name "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026551,phase:1,deny,status:403,msg:'Blocked XSS payload in bookly-customer-full-name cookie (CVE-2026-5513)'"