Bookly WordPress Plugin Stored XSS via Cookie Injection

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires 'Remember personal information in cookies' setting to be enabled (disabled by default).

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Bookly WordPress appointment booking plugin (versions ≤27.2) contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'bookly-customer-full-name' cookie due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject malicious JavaScript that persists in the application and executes whenever users access affected pages. The vulnerability is particularly dangerous because it requires no authentication, can compromise any site running vulnerable Bookly versions, and affects the booking workflow used by thousands of WordPress installations managing customer appointments and sensitive information.

Casky's 301 mapped security skills detect this vulnerability through Claude AI's extended reasoning applied to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Resource Development). Practitioners using Casky would observe detection patterns identifying: (1) cookie parameter injection attempts in HTTP requests targeting the booking system, (2) DOM-based and stored XSS payload signatures in customer name fields, (3) insufficient output encoding in rendered HTML responses, and (4) execution of unvalidated scripts in user browsers when pages load. The platform's skill coverage enables practitioners to identify both the exploitation phase and post-compromise persistence mechanisms, flagging malicious cookie values before they're stored in the database and detecting when injected scripts execute during page rendering—providing layered visibility into the attack chain from initial injection through victim exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5513.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-5513

Casky has 301 skills that investigate the attack patterns behind CVE-2026-5513. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn