Skip to content
PluginCanary

Online Scheduling and Appointment

Online Scheduling and Appointment Booking System - Bookly
by Bookly · 60,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 26 Oct 2026, 44 releases in 24 months, no unpatched vulnerabilities.

83/ 100 Canary Score
Sub-scores for Online Scheduling and Appointment
Ownership100
Maintenance100
Security60
Support70
Reputation85

How the score works

Quick answers

Is Online Scheduling and Appointment still maintained?
Yes. Last release 26 Oct 2026, 44 releases in the last 24 months. 26 Oct 2026 · wordpress.org
Who owns Online Scheduling and Appointment, and has it changed hands?
No change recorded. Main committer Ladela since Oct 2014. 4 Nov 2026 · SVN log
Was Online Scheduling and Appointment removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Online Scheduling and Appointment safe?
32 known vulnerabilities, all fixed (latest in 28.3). Not on the exploited list. 9 Oct 2026 · Wordfence Intelligence
Is the latest Online Scheduling and Appointment update safe to install?
No ownership change before 28.7. No one-star spike after it. 26 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Ladela10 Oct 2014 to 26 Oct 2026, 192 commits

1 committer recorded. No ownership change since 2014.

Maintenance

Last release
9 days ago
Releases, 24 months
44
Tested up to
7.1 current
Requires PHP
5.3.7 supported 8.2+
Releases per quarter
Releases per quarter for Online Scheduling and Appointment
Q1 20244
Q2 20245
Q3 20243
Q4 20247
Q1 20252
Q2 20251
Q3 20257
Q4 20257
Q1 20269
Q2 20265
Q3 20266
Q4 20264

Last release 26 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 4.8 (16 reviews). Lifetime: 4.4.

Average rating per quarter for Online Scheduling and Appointment
Q1 20265.0
Q2 20265.0
Q3 20265.0
Q4 20264.4

Average rating fell from 5.0 to 4.4 between Q1 2026 and Q4 2026.

Rating distribution
5 star468
4 star30
3 star19
2 star16
1 star53
Latest low reviews

Security record

24 vulnerabilities in 24 months (32 on record), all patched (latest fixed in 28.3).

Show 32 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
9 Oct 2026Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter7.2<= 28.228.3Patched before disclosure
9 Oct 2026Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body6.8<= 28.428.5Patched before disclosure
9 Oct 2026Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details5.3<= 28.428.5Patched before disclosure
25 Sep 2026Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference4.3<= 28.228.3Patched before disclosure
25 Sep 2026Bookly <= 28.2 - Unauthenticated Payment Bypass5.3<= 28.228.3Patched before disclosure
25 Sep 2026Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection7.523.2 to 28.228.3Patched before disclosure
25 Sep 2026Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference5.3<= 28.228.3Patched before disclosure
24 Sep 2026Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter9.1<= 28.228.3Patched before disclosure
24 Sep 2026Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data5.3<= 28.228.3Patched before disclosure
24 Sep 2026Online Scheduling and Appointment Booking System - Bookly <= 28.2 - Missing Authorization5.3<= 28.228.3Patched before disclosure
24 Sep 2026Online Scheduling and Appointment Booking System - Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3<= 28.228.3Patched before disclosure
17 Sep 2026Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference5.3<= 28.128.2Patched before disclosure
15 Sep 2026Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter7.5<= 28.128.2Patched before disclosure
7 Sep 2026Online Scheduling and Appointment Booking System - Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update5.4<= 27.227.3Patched before disclosure
15 Aug 2026Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action7.2<= 27.728.0Patched before disclosure
15 Aug 2026Online Scheduling and Appointment Booking System - Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter4.3<= 27.728.0Patched before disclosure
3 Aug 2026Online Scheduling and Appointment Booking System - Bookly < 27.8 - Unauthenticated SQL Injection7.5< 27.827.8Patched before disclosure
27 Jul 2026Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection7.5<= 27.727.8Patched before disclosure
16 Jul 2026Online Scheduling and Appointment Booking System - Bookly <= 27.7 - Unauthenticated SQL Injection7.5<= 27.727.8Patched before disclosure
16 Jul 2026Online Scheduling and Appointment Booking System - Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting7.2<= 27.727.8Patched before disclosure
12 Jun 2026Online Scheduling and Appointment Booking System - Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie7.2<= 27.227.3Patched before disclosure
10 May 2026Online Scheduling and Appointment Booking System - Bookly <= 27.4 - Unauthenticated Information Exposure5.3<= 27.427.5Patched before disclosure
8 Apr 2026Online Scheduling and Appointment Booking System - Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'5.3<= 27.027.1Patched before disclosure
20 Mar 2026Online Scheduling and Appointment Booking System - Bookly <= 26.7 - Reflected Cross-Site Scripting6.1<= 26.726.8Patched before disclosure
10 Jun 2024WordPress Online Booking and Scheduling Plugin - Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter6.4<= 23.223.3Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

60,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Online Scheduling and Appointment
4 May 20261,971
11 May 20263,715
18 May 20264,990
25 May 20266,032
1 Jun 202645,083
8 Jun 202617,782
15 Jun 20263,427
22 Jun 20262,819
29 Jun 20262,818
6 Jul 202623,874
13 Jul 202610,136
20 Jul 202616,869
27 Jul 202624,743
3 Aug 202626,448
10 Aug 20267,738
17 Aug 202616,011
24 Aug 202627,798
31 Aug 20264,798
7 Sep 202622,609
14 Sep 20269,400
21 Sep 202639,764
28 Sep 202624,384
5 Oct 202628,225
12 Oct 202625,002
19 Oct 20265,568
26 Oct 202626,853
2 Nov 2026834

Weekly downloads over the last 4 weeks are 8% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

SimplyBook.meScore 91 · 30,000+MotoPress Hotel Booking StylesScore 91 · 10,000+MotoPress Hotel Booking for ElementorScore 91 · 10,000+EMCScore 89 · 10,000+WP Simple Booking CalendarScore 86 · 10,000+

Facts

Version28.7
AuthorBookly
Added10 Oct 2014
Last updated26 Oct 2026
Active installs60,000+
Requires WordPress3.7
Tested up to7.1.4
Requires PHP5.3.7
CategoryBookings & Scheduling > Appointment Scheduling
Tagsbooking, appointments, booking system, booking calendar, appointment booking

Questions

Is Online Scheduling and Appointment still maintained?

Yes. Last release 26 Oct 2026, 44 releases in the last 24 months.

Who owns Online Scheduling and Appointment, and has it changed hands?

No change recorded. Main committer Ladela since Oct 2014.

Was Online Scheduling and Appointment removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Online Scheduling and Appointment safe?

32 known vulnerabilities, all fixed (latest in 28.3). Not on the exploited list.

Is the latest Online Scheduling and Appointment update safe to install?

No ownership change before 28.7. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue