Bookly, a WordPress appointment‑booking plugin, contains a reflected Cross‑Site Scripting vulnerability that allows attackers to inject arbitrary JavaScript into a page when the attacker crafts a specially composed URL. A victim who clicks the malicious link will execute the script in their browser, potentially compromising session cookies, defacing content, or conducting further attacks against the user. The flaw represents improper input validation, a classic client‑side weakness.

WordPress sites using the Bookly plugin version 26.7 or earlier are affected. The vulnerability applies to all editions of the plugin released up to that version, regardless of other installed plugins or themes.

The CVSS score of 7.1 indicates a moderate to high severity, with the attack likely occurring via a remote web request that a victim follows. The exploit does not require authentication or special user privileges, making it easier to target a broad user base. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but its client‑side nature still poses significant risk in user‑facing WordPress sites. An attacker can activate it simply by embedding a malicious link in email or social media.