CVE-2026-5513 is a stored Cross-Site Scripting vulnerability in the ladela Bookly WordPress plugin versions up to 27.2. The vulnerability is due to improper neutralization of input in the 'bookly-customer-full-name' cookie, enabling unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the affected pages. Exploitation depends on the 'Remember personal information in cookies' feature being enabled, which is off by default. No official patch or remediation guidance is currently documented by the vendor.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of users visiting the affected site, potentially leading to session hijacking, user impersonation, or other malicious actions impacting confidentiality and integrity. The vulnerability does not affect availability. The attack surface is limited by the requirement that the 'Remember personal information in cookies' setting be enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to keep the 'Remember personal information in cookies' setting disabled (default) to prevent exploitation. Monitor vendor channels for updates and apply official patches once released.