## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-87ACHRAFG-STACK-CVE-2026-5513
# CVE-2026-5513 https://t.me/FreeToolsCpa
CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group
Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting (XSS) Plugin Bookly — Online Scheduling and Appointment Booking System Affected ≤ 27.2 Patched 27.3+ CVSS 3.1 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CWE CWE-79 Auth Required None Prerequisite Remember personal information in cookies must be enabled (disabled by default) Description The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookly-customer-full-name cookie in versions up to and including 27.2 due to insufficient input sanitization and output escaping.
When the "Remember personal information in cookies" setting is enabled, the plugin reads the bookly-customer-full-name cookie value and renders it directly into the booking form HTML without proper escaping. An unauthenticated attacker can inject arbitrary JavaScript payloads via this cookie that execute whenever any user (including administrators) visits a page containing the Bookly booking form.
Attack Flow Attacker → Set malicious cookie (bookly-customer-full-name=) → Visit page with Bookly booking form → Plugin reads cookie, renders value without escaping → XSS payload executes in victim's browser context Root Cause // VULNERABLE — Bookly ≤ 27.2 $full_name = $_COOKIE['bookly-customer-full-name']; // No sanitization echo ''; // No escaping // PATCHED — Bookly 27.3+ $full_name = sanitize_text_field($_COOKIE['bookly-customer-full-name']); echo ''; Features ✓ Auto IP/Domain probing (HTTP/HTTPS, common ports, redirect detection) ✓ WordPress & Bookly plugin detection with version check ✓ Cookie setting detection (BooklyL10n JS analysis + canary reflection) ✓ Multi-context XSS testing (HTML, JavaScript, attribute injection) ✓ Payload injection with reflection verification ✓ Single target or mass scan from file ✓ Multi-threaded scanning (up to 20 threads) ✓ Proxy support (Burp, etc.) ✓ Auto-save vulnerable results ✓ Interactive menu + CLI modes Installation pip install requests colorama Usage CLI Mode