CVE-2026-5513: Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

Synopsis

Stored cross-site scripting (XSS) in the Bookly WordPress plugin (versions up to and including 27.2) allows an unauthenticated attacker to inject malicious JavaScript through the 'bookly-customer-full-name' cookie. The attack is reachable over the network with no authentication or victim interaction required, though it only succeeds when the 'Remember personal information in cookies' setting is enabled on the target site (disabled by default). Successful exploitation lets the injected script execute in the browsers of users who visit affected pages, enabling session theft, credential harvesting, or unauthorized actions on behalf of those users. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker sends a crafted HTTP request containing the malicious cookie value over the network to the target WordPress site.

• AuthenticationNot required

  No account or credentials of any kind are needed; the injection point is accessible to anonymous visitors.

• Victim interactionNot required

  No user interaction is needed to plant the payload; however, the payload executes in the browser of any user who subsequently loads an injected page.

• Attack complexityDetail

  The exploit is reliable and condition-free once the 'Remember personal information in cookies' setting is enabled on the target site; no race conditions or special memory layout is required.

Blast Radius

• Injected scripts run in the browsers of authenticated WordPress users (including admins) who visit affected pages, allowing the attacker to steal session cookies and hijack those accounts.
• The attacker can exfiltrate form data, saved credentials, or any content rendered on the affected page to an external server.
• Injected JavaScript can perform actions in the victim's browser on their behalf, such as creating new admin accounts or modifying site settings.
• Site integrity can be undermined by persistent script injection that redirects visitors, serves malicious downloads, or defaces page content.