Online Scheduling and Appointment Booking System – Bookly

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

337 searches this plugin appeared in over the last 90 days, 20 listed. 289 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 5 months ago and the previous band took 3 years to cross, so the real count is still just under 70K.

1. ★★★★★ kuehyunpark

   5mo ago

   2015년부터 작은 사이트를 운영하면서 Bookly Pro 와 여러 유료 플러그인을 구입해서 사용하고 있습니다. 무엇보다 쉽게 사용할 수 있고, 사용자 환경에 맞추어 커스텀이 가능하다는 점 그리고 고객응대 서비스가 좋다는 점을 말씀드리고 싶습니다. 얼마전에 플러그인 업데이트가 되면서 문제가 발생했었는데 티켓을 등록했더니 담당자가 직접 접속해서 해결해 주었습니다. 한국에서 사용하시는 분들이 별로 없는 것 같아서 일부러 한글로 리뷰를 남깁니다.

   Read on wp.org ↗
2. ★★★★★ roudsonmedine

   6mo ago

   bien

   Read on wp.org ↗
3. ★★★★★ medsclinic

   6mo ago

   Had a bit trouble using BOOKLY after migrating website from previous host. Shared the problem and it was resoved within 30minute.

   Read on wp.org ↗
4. ★★★★★ orenziv

   6mo ago

   Bookly is one of the most complete appointment booking plugins available for WordPress, and after working with several scheduling systems, it stands out as a powerful and flexible solution for service-based businesses. What makes Bookly particularly strong is its high level of customization. The booking form can be fully adapted—steps can be added or removed, fields customized, and even the design adjusted to match your brand . This makes it suitable for clinics, therapists, consultants, and any business that needs a professional booking flow. From a functionality standpoint, Bookly offers everything needed in one system: Online booking and calendar managementAutomated reminders (email/SMS)Payment integrations and depositsMulti-staff and multi-service scheduling It’s especially effective for businesses with more complex setups, like multiple practitioners or locations, where it handles availability and scheduling in a structured way . However, there are a few important downsides to consider: Many advanced features require paid add-ons, which can increase the total cost significantlyThe system can feel slightly complex for beginners, especially during setupSupport quality is sometimes inconsistent depending on the issue Overall, Bookly is not the simplest plugin—but it is one of the most powerful. If you are serious about running a professional booking system inside WordPress and want full control over your data and workflow, it’s an excellent choice. Final verdict:A robust, scalable booking solution best suited for professionals who want flexibility and are willing to invest a bit of time (and possibly money) to get the most out of it.

   Read on wp.org ↗
5. ★★★★★ stistko

   6mo ago

   I can highly recommend this booking system. Their support and problem-solving are very fast.

   Read on wp.org ↗
6. ★★★★★ Ahsan Waqas

   6mo ago

   Customer support is outstanding.

   Read on wp.org ↗
7. ★★★★★ pariscoiff

   7mo ago

   fonctionne bien dans notre salon de coiffure ! Je conseille

   Read on wp.org ↗
8. ★★★★★ gansado59

   7mo ago

   Excelente plugin. Funciona de maravilla en versión gratuita, por tanto, entiendo que la versión de pago será superior. Detectado un problema de funcionamiento en mi instalación, fué resuelto en pocas horas por su servicio técnico. El soporte es excepcionalmente rápido y resolutivo. Absolutamente recomendable.

   Read on wp.org ↗

All 32 disclosed vulnerabilities are patched in the current version (28.7). Sites still on an older version should update.

1. Patched High · 7.2 Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter ↗
   2026-10-09 CVE-2026-12626 Deserialization of Untrusted Data Affects <= 28.2 Patched in 28.3
2. Patched Medium · 6.8 Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body ↗
   2026-10-09 CVE-2026-104898 Authorization Bypass Through User-Controlled Key Affects <= 28.4 Patched in 28.5
3. Patched Medium · 5.3 Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details ↗
   2026-10-09 CVE-2026-103365 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 28.4 Patched in 28.5
4. Patched Medium · 5.3 Bookly <= 28.2 - Unauthenticated Payment Bypass ↗
   2026-09-25 CVE-2026-86838 Client-Side Enforcement of Server-Side Security Affects <= 28.2 Patched in 28.3
5. Patched High · 7.5 Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection ↗
   2026-09-25 CVE-2026-86841 Deserialization of Untrusted Data Affects 23.2 - 28.2 Patched in 28.3
6. Patched Medium · 4.3 Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference ↗
   2026-09-25 CVE-2026-86839 Authorization Bypass Through User-Controlled Key Affects <= 28.2 Patched in 28.3
7. Patched Medium · 5.3 Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference ↗
   2026-09-25 CVE-2026-86837 Authorization Bypass Through User-Controlled Key Affects <= 28.2 Patched in 28.3
8. Patched Critical · 9.1 Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter ↗
   2026-09-24 CVE-2026-93399 Authorization Bypass Through User-Controlled Key Affects <= 28.2 Patched in 28.3
9. Patched Medium · 5.3 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data ↗
   2026-09-24 CVE-2026-92799 Improper Authorization Affects <= 28.2 Patched in 28.3
10. Patched Medium · 5.3 Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization ↗
    2026-09-24 CVE-2026-96348 Missing Authorization Affects <= 28.2 Patched in 28.3
11. Patched Medium · 4.3 Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-09-24 CVE-2026-96347 Authorization Bypass Through User-Controlled Key Affects <= 28.2 Patched in 28.3
12. Patched Medium · 5.3 Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference ↗
    2026-09-17 CVE-2026-91847 Authorization Bypass Through User-Controlled Key Affects <= 28.1 Patched in 28.2
13. Patched High · 7.5 Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter ↗
    2026-09-15 CVE-2026-89063 Authorization Bypass Through User-Controlled Key Affects <= 28.1 Patched in 28.2
14. Patched Medium · 5.4 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update ↗
    2026-09-07 CVE-2026-2520 Missing Authorization Affects <= 27.2 Patched in 27.3
15. Patched High · 7.2 Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action ↗
    2026-08-15 CVE-2026-13424 Improper Neutralization of Input During Web Page Generation Affects <= 27.7 Patched in 28.0
16. Patched Medium · 4.3 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter ↗
    2026-08-15 CVE-2026-12905 Authorization Bypass Through User-Controlled Key Affects <= 27.7 Patched in 28.0
17. Patched High · 7.5 Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection ↗
    2026-08-03 CVE-2026-13395 Improper Neutralization of Special Elements used in an SQL Command Affects < 27.8 Patched in 27.8
18. Patched High · 7.5 Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection ↗
    2026-07-27 CVE-2026-14516 Improper Neutralization of Special Elements used in an SQL Command Affects <= 27.7 Patched in 27.8
19. Patched High · 7.2 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-07-16 CVE-2026-61944 Improper Neutralization of Input During Web Page Generation Affects <= 27.7 Patched in 27.8
20. Patched High · 7.5 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated SQL Injection ↗
    2026-07-16 CVE-2026-61949 Improper Neutralization of Special Elements used in an SQL Command Affects <= 27.7 Patched in 27.8
21. Patched High · 7.2 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie ↗
    2026-06-12 CVE-2026-5513 Improper Neutralization of Input During Web Page Generation Affects <= 27.2 Patched in 27.3
22. Patched Medium · 5.3 Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure ↗
    2026-05-10 CVE-2026-42667 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 27.4 Patched in 27.5
23. Patched Medium · 5.3 Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips' ↗
    2026-04-08 CVE-2026-2519 External Control of Assumed-Immutable Web Parameter Affects <= 27.0 Patched in 27.1
24. Patched Medium · 6.1 Online Scheduling and Appointment Booking System – Bookly <= 26.7 - Reflected Cross-Site Scripting ↗
    2026-03-20 CVE-2026-32540 Improper Neutralization of Input During Web Page Generation Affects <= 26.7 Patched in 26.8
25. Patched Medium · 6.4 WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter ↗
    2024-06-10 CVE-2024-5584 Improper Neutralization of Input During Web Page Generation Affects <= 23.2 Patched in 23.3
26. Patched Medium · 4.4 WordPress Online Booking and Scheduling Plugin – Bookly <= 22.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-11-06 CVE-2023-5209 Improper Neutralization of Input During Web Page Generation Affects <= 22.4.1 Patched in 22.5
27. Patched Medium · 6.6 Bookly <= 22.3.1 - Authenticated(Administrator+) SQL Injection ↗
    2023-09-25 CVE-2023-4691 Improper Neutralization of Special Elements used in an SQL Command Affects <= 22.3.1 Patched in 22.4
28. Patched Medium · 4.0 Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-06-01 CVE-2023-1159 Improper Neutralization of Input During Web Page Generation Affects 21.7 Patched in 21.8
29. Patched High · 8.1 Bookly <= 21.7.1 - Arbitrary File Deletion ↗
    2023-05-11 CVE-2023-26526 Missing Authorization Affects <= 21.7.1 Patched in 21.8
30. Patched High · 7.2 Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name ↗
    2023-03-17 CVE-2023-1172 Improper Neutralization of Input During Web Page Generation Affects 21.5 Patched in 21.5.1
31. Patched Medium · 5.4 Bookly <= 20.3 - Staff Member Stored Cross-Site Scripting ↗
    2021-11-08 CVE-2021-24930 Improper Neutralization of Input During Web Page Generation Affects <= 20.3 Patched in 20.3.1
32. Patched High · 7.2 WordPress Online Booking and Scheduling Plugin – Bookly <= 14.5 - Cross-Site Scripting ↗
    2018-02-10 CVE-2018-6891 Improper Neutralization of Input During Web Page Generation Affects <= 14.5 Patched in 14.6

Translated into 14 languages, 10 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

This plugin’s searches fall outside the topics measured so far. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-15 70K+ → 60K+ down after 1105 days in tier
2. 2023-06-06 60K+ → 70K+ up after 490 days in tier
3. 2022-02-01 50K+ → 60K+ up after 319 days in tier
4. 2021-03-19 40K+ → 50K+ up after 215 days in tier
5. 2020-08-16 30K+ → 40K+ up after 346 days in tier
6. 2019-09-05 20K+ → 30K+ up after 133 days in tier
7. 2019-04-25 10K+ → 20K+ up after 855 days in tier
8. 2016-12-21 6K+ → 10K+ up after 139 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Online Scheduling and Appointment Booking System – Bookly into a readme, a review or a deck. It updates itself.

Online Scheduling and Appointment Booking System – Bookly: 60K+ active installs, 4.4★ (586 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/bookly-responsive-appointment-booking-tool