CVE-2026-13424 is a stored cross-site scripting vulnerability in the Bookly WordPress plugin (versions <=27.7). The vulnerability exists in the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_*, allowing unauthenticated access. Attackers can submit malicious payloads that are stored verbatim in the bookly_log.details database column when requests lack a valid signature. These scripts execute later when an administrator accesses the Diagnostics → Logs page, potentially compromising administrative sessions or data.

An unauthenticated attacker can inject arbitrary web scripts that execute in the context of an administrator's browser when they view the plugin's Diagnostics → Logs page. This can lead to theft of administrative credentials, session hijacking, or other malicious actions limited to the administrator's privileges. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Diagnostics → Logs page to trusted administrators only and monitor for suspicious activity. Avoid exposing the vulnerable AJAX action to unauthenticated users if possible.