CVE-2026-5513: Bookly WordPress Plugin Stored XSS Vulnerability in Customer Name Cookies

Technical summary

Bookly stores customer names in browser cookies (via the 'bookly-customer-full-name' parameter) to provide a convenient 'remember me' experience. The plugin fails to properly sanitize data written to this cookie and does not adequately escape it when rendering the customer information back to the page. An attacker can craft a malicious cookie value containing JavaScript payloads. When a user with this cookie visits a page where Bookly displays customer data, the unescaped script executes in the user's browser within the context of the WordPress site, meeting the definition of Stored XSS. The attack vector is network-based with no privilege requirements, and the scope is changed (C:L/I:L) because the injected script can affect data confidentiality and integrity across the entire site session.

Business impact

A successful attack exposes customer data visible to users on the site, compromises user sessions, and can lead to account takeover or unauthorized actions performed on behalf of the victim. For appointment-driven businesses (salons, clinics, consulting firms), this represents reputational damage and potential regulatory exposure if customer information is harvested. The impact is especially significant if the WordPress site handles payment information or health/personal details during booking. Trust in the scheduling system is undermined, and customers may be reluctant to use or recommend the service.

Affected systems

The vulnerability affects the Bookly plugin for WordPress in all versions up to and including 27.2. The attack only succeeds if the site administrator has enabled the 'Remember personal information in cookies' setting, which is disabled by default. This means organizations running Bookly without that explicit opt-in are not vulnerable. Verify your plugin version and check the plugin settings under the customer information retention options to determine your exposure.

Exploitability

Exploitation does not require authentication or special user privileges—an unauthenticated attacker can inject a payload into a cookie. However, the attack requires either direct cookie injection (e.g., via malware on the user's device, compromised network, or cross-site request forgery) or the victim to visit a link that sets the cookie. The requirement for the 'Remember personal information' setting to be explicitly enabled raises the bar slightly, as most default installations are not vulnerable out-of-the-box. That said, any site with this feature turned on should treat this as a priority.

Remediation

Update the Bookly plugin to a version that includes input sanitization and proper output escaping of the customer name cookie. Check the plugin repository or vendor advisory for the patched version that addresses CVE-2026-5513. As an interim measure, disable the 'Remember personal information in cookies' setting in Bookly's configuration if the feature is not critical to your user experience. This eliminates the attack vector until a patch is applied.

Patch guidance

Visit your WordPress admin dashboard, navigate to Plugins, and check for available updates to Bookly. Apply the patch version released to address CVE-2026-5513—verify against the official plugin advisory or changelog to confirm the fix is included. If you maintain multiple WordPress sites, use your staging environment to test the update first to ensure compatibility with your active customizations. After patching, confirm that the 'Remember personal information in cookies' setting is still configured according to your security policy.

Detection guidance

Monitor for suspicious values in the 'bookly-customer-full-name' cookie on your WordPress site, especially entries containing script tags, event handlers (onclick, onerror), or encoded payloads. Review server logs and WAF logs for requests with unusual cookie values or reflected script content. Within WordPress, inspect the Bookly plugin logs or custom logging if available to spot anomalies in customer name fields. Watch for user complaints about unexpected redirects or JavaScript errors on booking pages, which may signal injected code execution.

Why prioritize this

With a CVSS score of 7.2 (HIGH), this vulnerability merits prompt attention. The combination of network accessibility, low attack complexity, and cross-site scope elevates the risk. However, the default-disabled status of the vulnerable feature means not all Bookly installations are exposed. Prioritize sites where you have confirmed the 'Remember personal information' feature is active, and patch those first. Secondary priority goes to instances on default configuration but where you plan to enable the feature in the future.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects a high-severity XSS vulnerability with network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and user interaction not needed (UI:N). The scope changes (S:C) because the injected script affects resources beyond the vulnerable component itself—it executes on the WordPress site and impacts other users. Confidentiality and Integrity are partially impacted (C:L/I:L) by the ability to steal session tokens or modify page content. Availability is not affected. The severity would be even higher if the default configuration enabled the vulnerable feature, but the opt-in nature moderates the score slightly in real-world practice.

Frequently asked questions