The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains an unauthenticated Stored Cross‑Site Scripting flaw tied to the bookly_speed_up_update_addons AJAX action. The action accepts input without proper sanitization and stores it directly in a database column that is later rendered by the Diagnostics → Logs page. When a site administrator views these logs, any attacker‑supplied script will execute in the administrator’s browser, allowing malicious code to run with the privileges of the logged‑in admin user.

WordPress sites running the Bookly plugin from vendor ladela, in any version up to and including 27.7, are affected. All supported releases below 27.8 contain the vulnerability, while releases 27.8 and later include the fix.

The flaw carries a CVSS score of 7.2, indicating a high severity and a high likelihood of compromise when the attack conditions are met. EPSS is not available, so exploitation probability cannot be quantified precisely, but the AJAX endpoint is publicly reachable and does not require authentication, making the attack path straightforward. The vulnerability is not listed in CISA’s KEV catalog as of the latest data. Attackers can deliver their payload via a crafted request to the AJAX endpoint and later trigger execution by having an administrator view the diagnostics logs, thereby gaining the ability to execute arbitrary JavaScript in the admin context.