The Bookly plugin for WordPress is affected by a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts, potentially compromising administrative accounts.

This is a stored cross-site scripting (CWE-79) vulnerability triggered via the bookly_speed_up_update_addons AJAX action. It allows unauthenticated attackers to store malicious payloads that execute when viewed by an administrator.

Exploitation of this vulnerability could facilitate session theft or the execution of unauthorized administrative commands, leading to total site compromise. The CVSS score of 7.2 highlights the severity of this flaw, making it a high priority for remediation.

Immediate Action: Update the Bookly plugin to version 28.0 or later immediately to resolve the vulnerability.

Proactive Monitoring: Monitor site logs for unusual AJAX traffic or unexpected modifications to plugin settings or administrative accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block malicious XSS payloads in incoming AJAX requests while the update is being staged.

Public Exploit Available: Unknown

The availability of a patch in version 28.0 makes remediation straightforward. All administrators are strongly advised to update the Bookly plugin immediately to mitigate the risk of cross-site scripting attacks.