{"vulnerability": "cve-2026-13424", "sightings": [{"uuid": "8f25e575-defc-42e6-8431-1c4f3771dc9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13424", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mt7bhrlmx323", "content": "CVE-2026-13424 bookly-responsive-appointment-booking-tool (CVSS Score 7.2) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-16T13:16:12.519413Z"}, {"uuid": "eb1a97b1-2684-437f-9876-d015c30be2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13424", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mtacykoh352t", "content": "CVE-2026-13424 bookly-responsive-appointment-booking-tool (CVSS Score 7.2) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-16T23:16:08.509676Z"}, {"uuid": "5d5f284d-4996-43a8-8a47-5402b14f649e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13424", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mt6sbibgd22p", "content": "The Bookly WordPress booking plugin (60k+ sites) has an unauthenticated stored XSS flaw, CVE-2026-13424.\n\nAnyone can plant a script that runs when an admin opens the plugin's logs.\n\nAffects versions up to 27.7. Update to 28.0, then check the log.", "creation_timestamp": "2026-08-16T08:44:15.033797Z"}, {"uuid": "5610a274-d46c-4168-8fa7-f1a8a5d95b95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13424", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mt6v52kmjl2r", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cBookly\u300d\uff08v27.7\u4ee5\u524d\uff09\u306f\u3001\u8ffd\u52a0\u6a5f\u80fd\u306e\u66f4\u65b0\u51e6\u7406\u306b\u304a\u3051\u308b\u5165\u529b\u4e0d\u5099\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u304c\u4efb\u610f\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u57cb\u3081\u8fbc\u3081\u308bStored XSS\u8106\u5f31\u6027\u3092\u6301\u3064\u3002\u7ba1\u7406\u8005\u753b\u9762\u8868\u793a\u6642\u306b\u30b9\u2026\nCVE-2026-13424 CVSS 7.2 | HIGH", "creation_timestamp": "2026-08-16T09:35:26.877432Z"}]}