CVE-2021-24930: Booking-Wp-Plugin Bookly

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

Affected products

• Booking-Wp-Plugin Bookly: before 20.3.1 (fixed in 20.3.1)

Published 2021-12-06. Last modified 2026-06-17.