CVE-2026-13424 is a stored cross-site scripting vulnerability in the Bookly plugin for WordPress, specifically in the bookly_speed_up_update_addons AJAX action registered as wp_ajax_nopriv_*, which allows unauthenticated attackers to submit malicious payloads. These payloads are stored verbatim in the bookly_log.details database column when requests lack a valid signature and execute when an administrator accesses the Diagnostics → Logs page. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). It affects all versions up to and including 27.7.

An unauthenticated attacker can inject malicious scripts that execute in the context of an administrator's browser when viewing the Diagnostics → Logs page. This can lead to partial confidentiality and integrity loss (e.g., theft of admin session data or manipulation of admin interface), but does not affect availability. The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity with scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Diagnostics → Logs page to trusted administrators only and monitor for suspicious AJAX requests to the bookly_speed_up_update_addons action. Avoid exposing this AJAX endpoint publicly if possible.