CVE-2018-6891

Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.

• CWE-79

• https://wordpress.org/plugins/bookly-responsive-appointment-booking-tool/#developersRelease Notes, Third Party Advisory
• https://www.gubello.me/blog/bookly-blind-stored-xss/Exploit, Third Party Advisory
• https://wordpress.org/plugins/bookly-responsive-appointment-booking-tool/#developersRelease Notes, Third Party Advisory
• https://www.gubello.me/blog/bookly-blind-stored-xss/Exploit, Third Party Advisory

Published

Feb 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6882Cross-site scripting (XSS) vulnerability in the ZmMailMsgVie…6.1
• CVE-2018-6883Piwigo before 2.9.3 has SQL injection in admin/tags.php in t…
• CVE-2018-6885An issue was discovered in MicroStrategy Web Services (the M…
• CVE-2018-6888An issue was discovered in Typesetter 5.1. The User Permissi…
• CVE-2018-6889An issue was discovered in Typesetter 5.1. It suffers from a…
• CVE-2018-6890Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1…
• CVE-2018-6892An issue was discovered in CloudMe before 1.11.0. An unauthe…
• CVE-2018-6893controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL I…
• CVE-2018-6900PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the…
• CVE-2018-6902PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the …
• CVE-2018-6903PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 us…
• CVE-2018-6904PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the Use…