Unknown Bookly vulnerabilities

2 CVEs affecting Unknown Bookly, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86838, published 2026-09-28.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-86838, published 2026-09-28. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the…
• CVE-2026-86837, published 2026-09-25. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary…